Apache OpenMeetings has Inadequate Encryption Strength

Also known as GHSA-cqm6-hrgq-6869

Published 9 y ago 2017-07-14 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.6%

percentile 77%

Public exploits

none known

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.

Exploit prediction (EPSS)

1.65% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`
GitHub	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
maven	`org.apache.openmeetings:openmeetings-parent`	>=1.0.0, <3.3.0	3.3.0

Affected products

Apache Software Foundation Apache OpenMeetings

Classification

Weakness

CWE-307 Improper Restriction of Excessive Authentication Attempts
CWE-326 Inadequate Encryption Strength

References

markmail.org /message/3hshl26omwjo6c5i · mailing-list, x_refsource_MLIST, x_transferred
securityfocus.com /bid/99587 · vdb-entry, x_refsource_BID, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-7673 · advisory
github.com /apache/openmeetings · package

Sources

CVE List: CVE-2017-7673
GitHub Advisory: GHSA-cqm6-hrgq-6869
NVD: CVE-2017-7673

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary