| |
| |
| <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> |
| <!-- |
| Generated by Apache Maven Doxia at 2018-02-23 |
| Rendered using Reflow Maven Skin 1.3.6 (http://devacfr.github.io/reflow-maven-skin) |
| --> |
| <html xml:lang="en" lang="en"> |
| |
| <head> |
| <meta charset="UTF-8" /> |
| <title>Apache OpenMeetings Project – Security Vulnerabilities</title> |
| <meta name="viewport" content="width=device-width, initial-scale=1.0" /> |
| <meta name="description" content="" /> |
| <meta name="author" content="Apache OpenMeetings Team" /> |
| <meta http-equiv="content-language" content="en" /> |
| <link href=".//css/bootstrap.min.css" rel="stylesheet" /> |
| <link href=".//css/bootstrap-responsive.min.css" rel="stylesheet" /> |
| <link href=".//css/docs.css" rel="stylesheet" /> |
| <link href=".//css/reflow-skin.css" rel="stylesheet" /> |
| |
| <link href=".//css/lightbox.css" rel="stylesheet" /> |
| <link href=".//css/site.css" rel="stylesheet" /> |
| <link href=".//css/print.css" rel="stylesheet" media="print" /> |
| <link rel="stylesheet" href=".//css/site.css"/> |
| </head> <!-- end : head --> |
| <body class="page-security project-openmeetings-server" data-spy="scroll" data-offset="70" data-target="#toc-scroll-target"> |
| |
| <div id="m-top-navbar" class="navbar navbar-default navbar-fixed-top"> |
| <div class="container"> |
| <!-- Brand and toggle get grouped for better mobile display --> |
| <div class="navbar-header"> |
| <button type="button" class="navbar-toggle collapsed" data-toggle="collapse" |
| data-target="#top-navbar-collapse-1" aria-expanded="false" aria-controls="navbar"> |
| <span class="sr-only">Toggle navigation</span> |
| <span class="icon-bar"></span> |
| <span class="icon-bar"></span> |
| <span class="icon-bar"></span> |
| </button> |
| <a class="navbar-brand" href="index.html"><span class="color-highlight">Apache</span> OpenMeetings</a> |
| </div> <!-- .navbar-header --> |
| <div class="collapse navbar-collapse" id="top-navbar-collapse-1"> |
| <ul class="nav navbar-nav navbar-right"> |
| <li ><a href="demo.html" title="Demo" >Demo</a></li> |
| <li ><a href="downloads.html" title="Download" >Download</a></li> |
| <li ><a href="https://cwiki.apache.org/confluence/display/OPENMEETINGS" title="Wiki" class="externalLink" >Wiki</a></li> |
| <li class="dropdown active"> |
| <a href="#" class="dropdown-toggle" data-toggle="dropdown">General <b class="caret"></b></a> |
| <ul class="dropdown-menu"> |
| <li ><a href="index.html" title="Home" >Home</a></li> |
| <li ><a href="http://www.apache.org/licenses/" title="License" class="externalLink" >License</a></li> |
| <li ><a href="http://www.apache.org/" title="ASF" class="externalLink" >ASF</a></li> |
| <li ><a href="https://www.apache.org/foundation/sponsorship" title="Sponsorship" class="externalLink" >Sponsorship</a></li> |
| <li ><a href="https://www.apache.org/foundation/thanks" title="Thanks" class="externalLink" >Thanks</a></li> |
| <li ><a href="CallForLogo.html" title="Call For Logo" >Call For Logo</a></li> |
| <li ><a href="NewsArchive.html" title="News archive" >News archive</a></li> |
| <li class="active" ><a href="" title="Security" >Security</a></li> |
| <li ><a href="commercial-support.html" title="Commercial Support" >Commercial Support</a></li> |
| </ul> |
| </li> |
| <li class="dropdown"> |
| <a href="#" class="dropdown-toggle" data-toggle="dropdown">Installation <b class="caret"></b></a> |
| <ul class="dropdown-menu"> |
| <li ><a href="installation.html" title="Installation" >Installation</a></li> |
| <li ><a href="Upgrade.html" title="Upgrade" >Upgrade</a></li> |
| <li ><a href="https://cwiki.apache.org/confluence/display/OPENMEETINGS/Tutorials+for+installing+OpenMeetings+and+Tools" title="Tutorials" class="externalLink" >Tutorials</a></li> |
| <li ><a href="CommandLineAdmin.html" title="Command Line Admin" >Command Line Admin</a></li> |
| </ul> |
| </li> |
| <li class="dropdown"> |
| <a href="#" class="dropdown-toggle" data-toggle="dropdown">Community <b class="caret"></b></a> |
| <ul class="dropdown-menu"> |
| <li ><a href="get-involved.html" title="Get Involved" >Get Involved</a></li> |
| <li ><a href="team-list.html" title="Committers" >Committers</a></li> |
| <li ><a href="OurUsers.html" title="Our Users" >Our Users</a></li> |
| <li ><a href="mail-lists.html" title="Mailing Lists" >Mailing Lists</a></li> |
| <li ><a href="http://cwiki.apache.org/confluence/display/OPENMEETINGS/" title="Wiki" class="externalLink" >Wiki</a></li> |
| </ul> |
| </li> |
| <li class="dropdown"> |
| <a href="#" class="dropdown-toggle" data-toggle="dropdown">Configuration <b class="caret"></b></a> |
| <ul class="dropdown-menu"> |
| <li class="dropdown-submenu "> |
| <a href="security.html#integration" title="Integration" >Integration</a> <ul class="dropdown-menu"> |
| <li ><a href="openmeetings-webservice/apidocs/index.html" title="SOAP/REST API" target="_blank" >SOAP/REST API</a></li> |
| <li ><a href="RestAPISample.html" title="REST API Sample" >REST API Sample</a></li> |
| <li ><a href="LdapAndADS.html" title="Ldap and ADS" >Ldap and ADS</a></li> |
| <li ><a href="oauth2.html" title="OAuth2" >OAuth2</a></li> |
| <li ><a href="voip-sip-integration.html" title="VoIP and SIP" >VoIP and SIP</a></li> |
| <li ><a href="errorvalues.html" title="Errors table" >Errors table</a></li> |
| <li ><a href="CalDAVandGCal.html" title="CalDAV and Google Calendar integration" >CalDAV and Google Calendar integration</a></li> |
| <li ><a href="ExternalVideo.html" title="External Video/Camera" >External Video/Camera</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#plugins" title="Plugins" >Plugins</a> <ul class="dropdown-menu"> |
| <li ><a href="MoodlePlugin.html" title="Moodle Plugin" >Moodle Plugin</a></li> |
| <li ><a href="SakaiPlugin.html" title="Sakai Plugin" >Sakai Plugin</a></li> |
| <li ><a href="JiraPlugin.html" title="Jira Plugin" >Jira Plugin</a></li> |
| <li ><a href="JoomlaPlugin.html" title="Joomla Plugin" >Joomla Plugin</a></li> |
| <li ><a href="DrupalPlugin.html" title="Drupal Plugin" >Drupal Plugin</a></li> |
| <li ><a href="BitrixPlugin.html" title="Bitrix Plugin" >Bitrix Plugin</a></li> |
| <li ><a href="ConfluencePlugin.html" title="Confluence Plugin" >Confluence Plugin</a></li> |
| <li ><a href="SugarCRMPlugin.html" title="SugarCRM Plugin" >SugarCRM Plugin</a></li> |
| <li ><a href="RedminePlugin.html" title="Redmine Plugin" >Redmine Plugin</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#db" title="DB Sample Configurations" >DB Sample Configurations</a> <ul class="dropdown-menu"> |
| <li ><a href="ApacheDerbyConfig.html" title="Apache Derby" >Apache Derby</a></li> |
| <li ><a href="IBMDB2Config.html" title="IBM DB2" >IBM DB2</a></li> |
| <li ><a href="OracleConfig.html" title="Oracle" >Oracle</a></li> |
| <li ><a href="MySQLConfig.html" title="MySQL" >MySQL</a></li> |
| <li ><a href="PostgresConfig.html" title="Postgres" >Postgres</a></li> |
| <li ><a href="MSSQLConfig.html" title="MSSQL" >MSSQL</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#localization" title="Localization and languages" >Localization and languages</a> <ul class="dropdown-menu"> |
| <li ><a href="Internationalisation.html" title="Internationalisation" >Internationalisation</a></li> |
| <li ><a href="LanguageEditor.html" title="LanguageEditor" >LanguageEditor</a></li> |
| <li ><a href="TimeZoneHandling.html" title="TimeZoneHandling" >TimeZoneHandling</a></li> |
| <li ><a href="EditTemplates.html" title="EditTemplates" >EditTemplates</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#port" title="NAT Port Settings" >NAT Port Settings</a> <ul class="dropdown-menu"> |
| <li ><a href="PortSettings.html" title="Port settings" >Port settings</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#performance" title="Performance" >Performance</a> <ul class="dropdown-menu"> |
| <li ><a href="JVMPerformanceTuning.html" title="JVM performance tuning" >JVM performance tuning</a></li> |
| <li ><a href="NetworkCalculator.html" title="Network bandwidth calculator" >Network bandwidth calculator</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#interface" title="User Interface" >User Interface</a> <ul class="dropdown-menu"> |
| <li ><a href="themes-and-branding.html" title="Themes" >Themes</a></li> |
| <li ><a href="Dashboard.html" title="Dashboard" >Dashboard</a></li> |
| <li ><a href="WebcamResolutions.html" title="Webcam resolutions" >Webcam resolutions</a></li> |
| <li ><a href="ConferenceRoomLayoutOptions.html" title="Room layout options" >Room layout options</a></li> |
| <li ><a href="HotKeys.html" title="Hot Keys" >Hot Keys</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#customize" title="Customization" >Customization</a> <ul class="dropdown-menu"> |
| <li ><a href="WebappNamePath.html" title="Webapp name/path" >Webapp name/path</a></li> |
| <li ><a href="Navigation.html" title="Navigation" >Navigation</a></li> |
| <li ><a href="CalendarAndTimezone.html" title="Calendar and timezone" >Calendar and timezone</a></li> |
| <li ><a href="CustomRoomTypeHowTo.html" title="Custom room type" >Custom room type</a></li> |
| <li ><a href="CustomCryptMechanism.html" title="Custom crypt mechanism" >Custom crypt mechanism</a></li> |
| <li ><a href="GeneralConfiguration.html" title="General Configuration" >General Configuration</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#security" title="Security" >Security</a> <ul class="dropdown-menu"> |
| <li ><a href="RestrictedAccess.html" title="Restricted Access" >Restricted Access</a></li> |
| <li ><a href="RTMPSAndHTTPS.html" title="RTMPS and HTTPS" >RTMPS and HTTPS</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#convert" title="Converters" >Converters</a> <ul class="dropdown-menu"> |
| <li ><a href="OpenOfficeConverter.html" title="OpenOffice Converter" >OpenOffice Converter</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#cluster" title="Clustering" >Clustering</a> <ul class="dropdown-menu"> |
| <li ><a href="Clustering.html" title="Clustering" >Clustering</a></li> |
| </ul> |
| </li> |
| <li class="dropdown-submenu "> |
| <a href="security.html#misc" title="Misc" >Misc</a> <ul class="dropdown-menu"> |
| <li ><a href="GetVersionInfo.html" title="Get version info" >Get version info</a></li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="dropdown"> |
| <a href="#" class="dropdown-toggle" data-toggle="dropdown">Development <b class="caret"></b></a> |
| <ul class="dropdown-menu"> |
| <li ><a href="source-repository.html" title="Source Code" >Source Code</a></li> |
| <li ><a href="issue-tracking.html" title="Bugs / Issues" >Bugs / Issues</a></li> |
| <li ><a href="dependencies.html" title="Dependencies" >Dependencies</a></li> |
| <li ><a href="integration.html" title="Continuous Integration" >Continuous Integration</a></li> |
| <li ><a href="BuildInstructions_3.0.x.html" title="Build Instructions 3.0.x" >Build Instructions 3.0.x</a></li> |
| <li ><a href="BuildInstructions.html" title="Build Instructions" >Build Instructions</a></li> |
| <li ><a href="JUnitTesting.html" title="JUnit Testing" >JUnit Testing</a></li> |
| <li ><a href="ManualTesting.html" title="Manual Testing" >Manual Testing</a></li> |
| <li ><a href="ReleaseGuide.html" title="Release Guide" >Release Guide</a></li> |
| <li ><a href="WebsiteGuide.html" title="Website Guide" >Website Guide</a></li> |
| </ul> |
| </li> |
| </ul> |
| </div><!--/.nav-collapse --> |
| </div> <!--/.container --> |
| </div> <!--/.navbar --> |
| <div class="container"> |
| <!-- Masthead --> |
| <!-- ================================================== --> <div class="header container-fluid"> |
| <div class="jumbotron subhead"> |
| <div class="row" id="banner"> |
| <div class="col-md-12"> |
| <div class="pull-left"> |
| <a href="index.html" id="bannerLeft"> |
| <img src="images/logo.png" |
| alt='"'Apache OpenMeetings'"' |
| /> </a> |
| </div> |
| <div class="pull-right"> |
| <a href="https://apache.org" id="bannerRight"> |
| <img src="https://apache.org/img/asf_logo.png" |
| alt='"'Apache'"' |
| /> </a> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div> |
| <ol class="breadcrumb"> |
| <li class="publishDate version-date"> |
| Last Published: 2018-02-23 |
| </li> |
| </ol> |
| </div> |
| </div> <!-- end : header --> |
| <div class="main-body"> |
| |
| <div class="row"> |
| <div class="col-md-8"> |
| <div class="body-content"> |
| <div class="section"> |
| <div class="page-header"> |
| <h2 id="_toc_security_vulnerabilities">Security Vulnerabilities</h2> |
| </div> |
| <p>Please note that binary patches are not produced for individual vulnerabilities. To obtain the binary fix for a particular vulnerability you should upgrade to an Apache OpenMeetings version where that vulnerability has been fixed.<br> <br> For more information about reporting vulnerabilities, see the <a class="externalLink" href="https://www.apache.org/security/">Apache Security Team</a> page.<br> <br> <a class="externalLink" href="https://www.apache.org/security/committers.html#vulnerability-handling">Vulnerability handling guide</a> </p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_reporting_new_security_problems">Reporting New Security Problems</h2> |
| <p> Please report any security errors to security@openmeetings.apache.org<br> <br> Please NOTE: only security issues should be reported to this list. </p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-15719_-_wicket_jquery_ui_xss_in_wysiwyg_e">CVE-2017-15719 - Wicket jQuery UI: XSS in WYSIWYG editor</h2> |
| <p>Severity: High</p> |
| <p>Vendor: wicket-jquery-ui</p> |
| <p>Versions Affected: <= 6.28.0, <= 7.9.1, <= 8.0.0-M8</p> |
| <p>Description: Attacker can submit arbitrary JS code to WYSIWYG editor<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15719">CVE-2017-15719</a> </p> |
| <p>The issue was fixed in 6.28.1, 7.9.2, 8.0.0-M8.1<br> All users are recommended to upgrade to Apache OpenMeetings 4.0.2</p> |
| <p>Credit: This issue was identified by Sahil Dhar of Security Innovation Inc</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2018-1286_-_apache_openmeetings_-_insufficient">CVE-2018-1286 - Apache OpenMeetings - Insufficient Access Controls</h2> |
| <p>Severity: Medium</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 3.0.0 - 4.0.1</p> |
| <p>Description: CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1286">CVE-2018-1286</a> </p> |
| <p>The issue was fixed in 4.0.2<br> All users are recommended to upgrade to Apache OpenMeetings 4.0.2</p> |
| <p>Credit: This issue was identified by Sahil Dhar of Security Innovation Inc</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7663_-_apache_openmeetings_-_xss_in_chat">CVE-2017-7663 - Apache OpenMeetings - XSS in chat</h2> |
| <p>Severity: High</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 3.2.0</p> |
| <p>Description: Both global and Room chat are vulnerable to XSS attack<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7663">CVE-2017-7663</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7664_-_apache_openmeetings_-_missing_xml_">CVE-2017-7664 - Apache OpenMeetings - Missing XML Validation</h2> |
| <p>Severity: High</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 3.1.0</p> |
| <p>Description: Uploaded XML documents were not correctly validated<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7664">CVE-2017-7664</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7666_-_apache_openmeetings_missing_secure">CVE-2017-7666 - Apache OpenMeetings Missing Secure Headers</h2> |
| <p>Severity: High</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.0.0</p> |
| <p>Description: Apache Openmeetings is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7666">CVE-2017-7666</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7673_-_apache_openmeetings_insufficient_c">CVE-2017-7673 - Apache OpenMeetings Insufficient check in dialogs with passwords</h2> |
| <p>Severity: High</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.0.0</p> |
| <p>Description: Apache OpenMeetings uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7673">CVE-2017-7673</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7680_-_apache_openmeetings_-_insecure_cro">CVE-2017-7680 - Apache OpenMeetings - Insecure crossdomain.xml policy</h2> |
| <p>Severity: Low</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.0.0</p> |
| <p>Description: Apache OpenMeetings has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7680">CVE-2017-7680</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7681_-_apache_openmeetings_-_sql_injectio">CVE-2017-7681 - Apache OpenMeetings - SQL injection in web services</h2> |
| <p>Severity: High</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.0.0</p> |
| <p>Description: Apache OpenMeetings is vulnerable to SQL injection This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7681">CVE-2017-7681</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7682_-_apache_openmeetings_-_business_log">CVE-2017-7682 - Apache OpenMeetings - Business Logic Bypass</h2> |
| <p>Severity: Medium</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 3.2.0</p> |
| <p>Description: Apache OpenMeetings is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7682">CVE-2017-7682</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7683_-_apache_openmeetings_-_information_">CVE-2017-7683 - Apache OpenMeetings - Information Disclosure</h2> |
| <p>Severity: Lowest</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.0.0</p> |
| <p>Description: Apache OpenMeetings displays Tomcat version and detailed error stack trace which is not secure.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7683">CVE-2017-7683</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7684_-_apache_openmeetings_-_insecure_fil">CVE-2017-7684 - Apache OpenMeetings - Insecure File Upload</h2> |
| <p>Severity: Low</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.0.0</p> |
| <p>Description: Apache OpenMeetings doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7684">CVE-2017-7684</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7685_-_apache_openmeetings_-_insecure_htt">CVE-2017-7685 - Apache OpenMeetings - Insecure HTTP Methods</h2> |
| <p>Severity: Lowest</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.0.0</p> |
| <p>Description: Apache OpenMeetingsrespond to the following insecure HTTP Methods: PUT, DELETE, HEAD, and PATCH.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7685">CVE-2017-7685</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-7688_-_apache_openmeetings_-_insecure_pas">CVE-2017-7688 - Apache OpenMeetings - Insecure Password Update</h2> |
| <p>Severity: Low</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.0.0</p> |
| <p>Description: Apache OpenMeetings updates user password in insecure manner.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7688">CVE-2017-7688</a> </p> |
| <p>The issue was fixed in 3.3.0<br> All users are recommended to upgrade to Apache OpenMeetings 3.3.0</p> |
| <p>Credit: This issue was identified by Security Innovation</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2017-5878_-_red5amf_unmarshalling_rce">CVE-2017-5878 - RED5/AMF Unmarshalling RCE</h2> |
| <p>Severity: Critical</p> |
| <p>Vendor: Red5</p> |
| <p>Versions Affected: Apache OpenMeetings 3.1.3 and earlier</p> |
| <p>Description: The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5878">CVE-2017-5878</a> </p> |
| <p>The issue was fixed in 3.1.4<br> All users are recommended to upgrade to Apache OpenMeetings 3.1.4</p> |
| <p>Credit: This issue was identified by Moritz Bechler</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2016-8736_-_apache_openmeetings_rmi_registry_j">CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE</h2> |
| <p>Severity: Moderate</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 3.1.0</p> |
| <p>Description: Apache Openmeetings is vulnerable to Remote Code Execution via RMI deserialization attack<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8736">CVE-2016-8736</a> </p> |
| <p>The issue was fixed in 3.1.2<br> All users are recommended to upgrade to Apache OpenMeetings 3.1.3</p> |
| <p>Credit: This issue was identified by Jacob Baines, Tenable Network Security</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2016-3089_-_apache_openmeetings_xss_in_swf_pan">CVE-2016-3089 - Apache OpenMeetings XSS in SWF panel</h2> |
| <p>Severity: Moderate</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 3.1.0</p> |
| <p>Description: The value of the URL's "swf" query parameter is interpolated into the JavaScript tag without being escaped, leading to the reflected XSS.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3089">CVE-2016-3089</a> </p> |
| <p>All users are recommended to upgrade to Apache OpenMeetings 3.1.2</p> |
| <p>Credit: This issue was identified by Matthew Daley</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2016-0783_-_predictable_password_reset_token">CVE-2016-0783 - Predictable password reset token</h2> |
| <p>Severity: Critical</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.9.x - 3.1.0</p> |
| <p>Description: The hash generated by the external password reset function is generated by concatenating the user name and the current system time, and then hashing it using MD5. This is highly predictable and can be cracked in seconds by an attacker with knowledge of the user name of an OpenMeetings user.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0783">CVE-2016-0783</a> </p> |
| <p>All users are recommended to upgrade to Apache OpenMeetings 3.1.1</p> |
| <p>Credit: This issue was identified by Andreas Lindh</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2016-0784_-_zip_file_path_traversal">CVE-2016-0784 - ZIP file path traversal</h2> |
| <p>Severity: Moderate</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.9.x - 3.1.0</p> |
| <p>Description: The Import/Export System Backups functionality in the OpenMeetings Administration menu (http://domain:5080/openmeetings/#admin/backup) is vulnerable to path traversal via specially crafted file names within ZIP archives. By uploading an archive containing a file named ../../../public/hello.txt will write the file “hello.txt” to the http://domain:5080/openmeetings/public/ directory. This could be used to, for example, overwrite the /usr/bin/convert file (or any other 3 rd party integrated executable) with a shell script, which would be executed the next time an image file is uploaded and imagemagick is invoked.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0784">CVE-2016-0784</a> </p> |
| <p>All users are recommended to upgrade to Apache OpenMeetings 3.1.1</p> |
| <p>Credit: This issue was identified by Andreas Lindh</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2016-2163_-_stored_cross_site_scripting_in_eve">CVE-2016-2163 - Stored Cross Site Scripting in Event description</h2> |
| <p>Severity: Moderate</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.9.x - 3.0.7</p> |
| <p>Description: When creating an event, it is possible to create clickable URL links in the event description. These links will be present inside the event details once a participant enters the room via the event. It is possible to create a link like "javascript:alert('xss')", which will execute once the link is clicked. As the link is placed within an <a> tag, the actual link is not visible to the end user which makes it hard to tell if the link is legit or not.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2163">CVE-2016-2163</a> </p> |
| <p>All users are recommended to upgrade to Apache OpenMeetings 3.1.1</p> |
| <p>Credit: This issue was identified by Andreas Lindh</p> |
| </div> |
| <div class="section"> |
| <h2 id="_toc_cve-2016-2164_-_arbitrary_file_read_via_soap_api">CVE-2016-2164 - Arbitrary file read via SOAP API</h2> |
| <p>Severity: Critical</p> |
| <p>Vendor: The Apache Software Foundation</p> |
| <p>Versions Affected: Apache OpenMeetings 1.9.x - 3.0.7</p> |
| <p>Description: When attempting to upload a file via the API using the importFileByInternalUserId or importFile methods in the FileService, it is possible to read arbitrary files from the system. This is due to that Java's URL class is used without checking what protocol handler is specified in the API call.<br> <a class="externalLink" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2164">CVE-2016-2164</a> </p> |
| <p>All users are recommended to upgrade to Apache OpenMeetings 3.1.1</p> |
| <p>Credit: This issue was identified by Andreas Lindh</p> |
| </div> </div> |
| </div> |
| <div class="col-md-4"> |
| <div id="toc-sidebar" class="hidden-print hidden-xs hidden-sm" data-spy="affix" > |
| |
| <div id="toc-scroll-target"> |
| <div class="well"> |
| <ul class="nav m-nav--sidebar m-aside-toc"> |
| <li class="nav-header">Table of Contents</li> |
| <li> |
| <a href="#_toc_security_vulnerabilities" title="Security Vulnerabilities"> |
| <span class="fa fa-angle-double-right"></span> Security Vulnerabilities |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_reporting_new_security_problems" title="Reporting New Security Problems"> |
| <span class="fa fa-angle-double-right"></span> Reporting New Security Problems |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-15719_-_wicket_jquery_ui_xss_in_wysiwyg_e" title="CVE-2017-15719 - Wicket jQuery UI: XSS in WYSIWYG editor"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-15719 - Wicket jQuery UI: XSS in WYSIWYG editor |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2018-1286_-_apache_openmeetings_-_insufficient" title="CVE-2018-1286 - Apache OpenMeetings - Insufficient Access Controls"> |
| <span class="fa fa-angle-double-right"></span> CVE-2018-1286 - Apache OpenMeetings - Insufficient Access Controls |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7663_-_apache_openmeetings_-_xss_in_chat" title="CVE-2017-7663 - Apache OpenMeetings - XSS in chat"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7663 - Apache OpenMeetings - XSS in chat |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7664_-_apache_openmeetings_-_missing_xml_" title="CVE-2017-7664 - Apache OpenMeetings - Missing XML Validation"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7664 - Apache OpenMeetings - Missing XML Validation |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7666_-_apache_openmeetings_missing_secure" title="CVE-2017-7666 - Apache OpenMeetings Missing Secure Headers"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7666 - Apache OpenMeetings Missing Secure Headers |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7673_-_apache_openmeetings_insufficient_c" title="CVE-2017-7673 - Apache OpenMeetings Insufficient check in dialogs with passwords"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7673 - Apache OpenMeetings Insufficient check in dialogs with passwords |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7680_-_apache_openmeetings_-_insecure_cro" title="CVE-2017-7680 - Apache OpenMeetings - Insecure crossdomain.xml policy"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7680 - Apache OpenMeetings - Insecure crossdomain.xml policy |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7681_-_apache_openmeetings_-_sql_injectio" title="CVE-2017-7681 - Apache OpenMeetings - SQL injection in web services"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7681 - Apache OpenMeetings - SQL injection in web services |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7682_-_apache_openmeetings_-_business_log" title="CVE-2017-7682 - Apache OpenMeetings - Business Logic Bypass"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7682 - Apache OpenMeetings - Business Logic Bypass |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7683_-_apache_openmeetings_-_information_" title="CVE-2017-7683 - Apache OpenMeetings - Information Disclosure"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7683 - Apache OpenMeetings - Information Disclosure |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7684_-_apache_openmeetings_-_insecure_fil" title="CVE-2017-7684 - Apache OpenMeetings - Insecure File Upload"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7684 - Apache OpenMeetings - Insecure File Upload |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7685_-_apache_openmeetings_-_insecure_htt" title="CVE-2017-7685 - Apache OpenMeetings - Insecure HTTP Methods"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7685 - Apache OpenMeetings - Insecure HTTP Methods |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-7688_-_apache_openmeetings_-_insecure_pas" title="CVE-2017-7688 - Apache OpenMeetings - Insecure Password Update"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-7688 - Apache OpenMeetings - Insecure Password Update |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2017-5878_-_red5amf_unmarshalling_rce" title="CVE-2017-5878 - RED5/AMF Unmarshalling RCE"> |
| <span class="fa fa-angle-double-right"></span> CVE-2017-5878 - RED5/AMF Unmarshalling RCE |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2016-8736_-_apache_openmeetings_rmi_registry_j" title="CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE"> |
| <span class="fa fa-angle-double-right"></span> CVE-2016-8736 - Apache Openmeetings RMI Registry Java Deserialization RCE |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2016-3089_-_apache_openmeetings_xss_in_swf_pan" title="CVE-2016-3089 - Apache OpenMeetings XSS in SWF panel"> |
| <span class="fa fa-angle-double-right"></span> CVE-2016-3089 - Apache OpenMeetings XSS in SWF panel |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2016-0783_-_predictable_password_reset_token" title="CVE-2016-0783 - Predictable password reset token"> |
| <span class="fa fa-angle-double-right"></span> CVE-2016-0783 - Predictable password reset token |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2016-0784_-_zip_file_path_traversal" title="CVE-2016-0784 - ZIP file path traversal"> |
| <span class="fa fa-angle-double-right"></span> CVE-2016-0784 - ZIP file path traversal |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2016-2163_-_stored_cross_site_scripting_in_eve" title="CVE-2016-2163 - Stored Cross Site Scripting in Event description"> |
| <span class="fa fa-angle-double-right"></span> CVE-2016-2163 - Stored Cross Site Scripting in Event description |
| </a> |
| </li> |
| <li> |
| <a href="#_toc_cve-2016-2164_-_arbitrary_file_read_via_soap_api" title="CVE-2016-2164 - Arbitrary file read via SOAP API"> |
| <span class="fa fa-angle-double-right"></span> CVE-2016-2164 - Arbitrary file read via SOAP API |
| </a> |
| </li> |
| </ul> |
| </div> |
| </div> |
| |
| </div> |
| </div> <!-- /row --> |
| </div> |
| </div> <!-- end : row --> |
| </div> <!-- /container --> |
| <!-- Footer |
| ================================================== --> |
| <footer class="well"> |
| <div class="container"> |
| <div class="row"> |
| <div class="col-md-3 bottom-nav"> |
| |
| <ul class="nav nav-list"> |
| <li class="nav-header">General</li> |
| <li ><a href="index.html" title="Home" >Home</a></li> |
| <li ><a href="http://www.apache.org/licenses/" title="License" class="externalLink" >License</a></li> |
| <li ><a href="http://www.apache.org/" title="ASF" class="externalLink" >ASF</a></li> |
| <li ><a href="https://www.apache.org/foundation/sponsorship" title="Sponsorship" class="externalLink" >Sponsorship</a></li> |
| <li ><a href="https://www.apache.org/foundation/thanks" title="Thanks" class="externalLink" >Thanks</a></li> |
| <li ><a href="CallForLogo.html" title="Call For Logo" >Call For Logo</a></li> |
| <li ><a href="NewsArchive.html" title="News archive" >News archive</a></li> |
| <li class="active" ><a href="#" title="Security" >Security</a></li> |
| <li ><a href="commercial-support.html" title="Commercial Support" >Commercial Support</a></li> |
| </ul> |
| |
| </div> |
| <div class="col-md-3 bottom-nav"> |
| |
| <ul class="nav nav-list"> |
| <li class="nav-header">Installation</li> |
| <li ><a href="installation.html" title="Installation" >Installation</a></li> |
| <li ><a href="Upgrade.html" title="Upgrade" >Upgrade</a></li> |
| <li ><a href="https://cwiki.apache.org/confluence/display/OPENMEETINGS/Tutorials+for+installing+OpenMeetings+and+Tools" title="Tutorials" class="externalLink" >Tutorials</a></li> |
| <li ><a href="CommandLineAdmin.html" title="Command Line Admin" >Command Line Admin</a></li> |
| </ul> |
| |
| </div> |
| <div class="col-md-3 bottom-nav"> |
| |
| <ul class="nav nav-list"> |
| <li class="nav-header">Community</li> |
| <li ><a href="get-involved.html" title="Get Involved" >Get Involved</a></li> |
| <li ><a href="team-list.html" title="Committers" >Committers</a></li> |
| <li ><a href="OurUsers.html" title="Our Users" >Our Users</a></li> |
| <li ><a href="mail-lists.html" title="Mailing Lists" >Mailing Lists</a></li> |
| <li ><a href="http://cwiki.apache.org/confluence/display/OPENMEETINGS/" title="Wiki" class="externalLink" >Wiki</a></li> |
| </ul> |
| |
| </div> |
| <div class="col-md-3 bottom-nav"> |
| |
| <ul class="nav nav-list"> |
| <li class="nav-header">Development</li> |
| <li ><a href="source-repository.html" title="Source Code" >Source Code</a></li> |
| <li ><a href="issue-tracking.html" title="Bugs / Issues" >Bugs / Issues</a></li> |
| <li ><a href="dependencies.html" title="Dependencies" >Dependencies</a></li> |
| <li ><a href="integration.html" title="Continuous Integration" >Continuous Integration</a></li> |
| <li ><a href="BuildInstructions_3.0.x.html" title="Build Instructions 3.0.x" >Build Instructions 3.0.x</a></li> |
| <li ><a href="BuildInstructions.html" title="Build Instructions" >Build Instructions</a></li> |
| <li ><a href="JUnitTesting.html" title="JUnit Testing" >JUnit Testing</a></li> |
| <li ><a href="ManualTesting.html" title="Manual Testing" >Manual Testing</a></li> |
| <li ><a href="ReleaseGuide.html" title="Release Guide" >Release Guide</a></li> |
| <li ><a href="WebsiteGuide.html" title="Website Guide" >Website Guide</a></li> |
| </ul> |
| |
| </div> |
| </div> |
| </div> |
| </footer> |
| <div class="container subfooter"> |
| <div class="row"> |
| <div class="col-md-12"> |
| <p class="pull-right"><a id="m-scroll-top" href="#">Back to top</a></p> |
| <p class="copyright">Copyright ©2012-2018 <a href="http://apache.org">Apache Software Foundation</a> |
| . All Rights Reserved.</p> |
| <p>Apache OpenMeetings, OpenMeetings, Apache, the Apache feather, and the Apache OpenMeetings project logo</p> |
| <p>are trademarks of the Apache Software Foundation.</p> |
| </div> |
| </div> |
| </div> |
| <!-- Le javascript |
| ================================================== --> |
| <!-- Placed at the end of the document so the pages load faster --> |
| <script src=".//js/jquery.min.js"></script> |
| <script src=".//js/bootstrap.min.js"></script> |
| |
| <script src=".//js/lightbox.min.js"></script> |
| |
| <script src=".//js/reflow-scroll.js"></script> |
| |
| <script src=".//js/site.js" type="text/javascript"></script> |
| <script src=".//js/jquery-ui.min.js" type="text/javascript"></script> |
| <script src=".//js/netcalc.js" type="text/javascript"></script> <script src=".//js/reflow-skin.js"></script> |
| <script src=".//js/anchor.min.js"></script> |
| <script> |
| document.addEventListener("DOMContentLoaded", function(event) { |
| anchors.options = { |
| placement: 'left', |
| }; |
| anchors.add('h1,h2, h3, h4, h5, h6'); |
| }); |
| </script> |
| |
| </body> |
| </html> |
