CVE-2017-7681 Apache OpenMeetings vulnerable to SQL injection
HighCVSS 8.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.openmeetings/openmeetings-parent(Maven) | >= 1.0.0, < 3.3.0 | 3.3.0 |
| org.apache.openmeetings/openmeetings-parent(Maven) | = 3.1.2 | No fix listed |
| org.apache.openmeetings/openmeetings-parent(Maven) | = 3.1.3 | No fix listed |
| org.apache.openmeetings/openmeetings-parent(Maven) | = 3.1.4 | No fix listed |
| org.apache.openmeetings/openmeetings-parent(Maven) | = 3.1.5 | No fix listed |
| org.apache.openmeetings/openmeetings-parent(Maven) | = 3.2.0 | No fix listed |
| org.apache.openmeetings/openmeetings-parent(Maven) | = 3.2.1 | No fix listed |
| apache openmeetings | = 1.0.0 | No fix listed |
| apache openmeetings | = 2.0 | No fix listed |
| apache openmeetings | = 2.1 | No fix listed |
| apache openmeetings | = 2.1.1 | No fix listed |
| apache openmeetings | = 2.2.0 | No fix listed |
| apache openmeetings | = 3.0.0 | No fix listed |
| apache openmeetings | = 3.0.1 | No fix listed |
| apache openmeetings | = 3.0.2 | No fix listed |
| apache openmeetings | = 3.0.3 | No fix listed |
| apache openmeetings | = 3.0.4 | No fix listed |
| apache openmeetings | = 3.0.5 | No fix listed |
| apache openmeetings | = 3.0.6 | No fix listed |
| apache openmeetings | = 3.0.7 | No fix listed |
| apache openmeetings | = 3.1.0 | No fix listed |
| apache openmeetings | = 3.1.1 | No fix listed |
| apache openmeetings | = 3.1.2 | No fix listed |
| apache openmeetings | = 3.1.3 | No fix listed |
| apache openmeetings | = 3.1.4 | No fix listed |
Show 4 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache openmeetings | = 3.1.5 | No fix listed |
| apache openmeetings | = 3.2.0 | No fix listed |
| apache openmeetings | = 3.2.1 | No fix listed |
| Apache OpenMeetings | = 1.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- [user] 20170713 CVE-2017-7681 - Apache OpenMeetings - SQL injection in web services mailing-list third-party-advisory
- github.com