8.8high
CVE-2017-7681
Apache OpenMeetings vulnerable to SQL injection
Also known as GHSA-335g-xcjh-ghc2
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 70%
Public exploits
0
none known
Summary
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
Exploit prediction (EPSS)
1.29% probability of exploitation in the next 30 days, higher than 70% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.apache.openmeetings:openmeetings-parent | >=1.0.0, <3.3.0 | 3.3.0 |
Affected products
- Apache Software Foundation Apache OpenMeetings
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- markmail.org /message/j774dp5ro5xmkmg6 · mailing-list, x_refsource_MLIST, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-7681 · advisory
- github.com /apache/openmeetings · package
Sources
- CVE List: CVE-2017-7681
- GitHub Advisory: GHSA-335g-xcjh-ghc2
- NVD: CVE-2017-7681
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.