High severity · published Jul 17, 2017
CVE-2017-7681
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection
8.8
CVSS
1.3%
EPSS
No
On KEV
Description
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openmeetings · Apache
1.0.0; 2.0; 2.1; 2.1.1; 2.2.0; 3.0.0; +15 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7681
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7681
Mailing List
http://markmail.org/message/j774dp5ro5xmkmg6
More from Openmeetings
10.0
CVE-2017-7664
Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0
9.8
CVE-2024-54676
Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
9.8
CVE-2023-28326
Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in any room
9.8
CVE-2016-8736
Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack
9.8
CVE-2017-7673
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection