High severity · published Apr 11, 2016
CVE-2016-0783
The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user…
7.5
CVSS
7.1%
EPSS
No
On KEV
Description
The sendHashByUser function in Apache OpenMeetings before 3.1.1 generates predictable password reset tokens, which makes it easier for remote attackers to reset arbitrary user passwords by leveraging knowledge of a user name and the current system time.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.1% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openmeetings · Apache
through 3.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-0783
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-0783
haxx.ml
http://haxx.ml/post/141655340521/all-your-meetings-are-belong-to-us-remote-code
Patch
http://openmeetings.apache.org/security.html
packetstormsecurity.com
http://packetstormsecurity.com/files/136432/Apache-OpenMeetings-3.1.0-MD5-Hashing.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/537886/100/0/threaded
www.apache.org
https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG
More from Openmeetings
10.0
CVE-2017-7664
Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0
9.8
CVE-2024-54676
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
9.8
CVE-2023-28326
Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room
9.8
CVE-2016-8736
Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack
9.8
CVE-2017-7673
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection