Critical severity · published Jul 17, 2017
CVE-2017-7673
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openmeetings · Apache
1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7673
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7673
Mailing List
http://markmail.org/message/3hshl26omwjo6c5i
Third Party Advisory
http://www.securityfocus.com/bid/99587
More from Openmeetings
10.0
CVE-2017-7664
Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0
9.8
CVE-2024-54676
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
9.8
CVE-2023-28326
Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room
9.8
CVE-2016-8736
Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack
8.8
CVE-2017-7681
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection