CVE-2016-0784 Apache OpenMeetings Directory Traversal vulnerability
MediumCVSS 6.5
EPSS 54.7%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.openmeetings/openmeetings-install(Maven) | >= 1.9.0, < 3.1.1 | 3.1.1 |
| apache openmeetings | <= 3.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- web.archive.org
- web.archive.org
- web.archive.org
- web.archive.org
- 39642 exploit
- openmeetings.apache.org patch vendor-advisory
- [oss-security] 20160325 [CVE-2016-0784] ZIP file path traversal mailing-list
- haxx.ml
- packetstormsecurity.com
- 20160330 [CVE-2016-0784] Apache OpenMeetings ZIP file path traversal mailing-list
- www.apache.org vendor-advisory
- github.com