High severity · published Apr 11, 2016
CVE-2016-2164
The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without…
7.5
CVSS
7%
EPSS
No
On KEV
Description
The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.0% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openmeetings · Apache
through 3.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-2164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-2164
Patch
http://openmeetings.apache.org/security.html
packetstormsecurity.com
http://packetstormsecurity.com/files/136434/Apache-OpenMeetings-3.0.7-Arbitary-File-Read.html
www.securityfocus.com
http://www.securityfocus.com/archive/1/537887/100/0/threaded
www.apache.org
https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG
More from Openmeetings
10.0
CVE-2017-7664
Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0
9.8
CVE-2024-54676
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
9.8
CVE-2023-28326
Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room
9.8
CVE-2016-8736
Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack
9.8
CVE-2017-7673
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection