SB2023051207 - Multiple vulnerabilities in Apache Openmeetings

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023051207

SB2023051207 - Multiple vulnerabilities in Apache Openmeetings

Published: May 12, 2023

Security Bulletin ID SB2023051207
Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Improper access control (CVE-ID: CVE-2023-28936)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions when handling invitations. A remote attacker can bypass implemented security restrictions and access an arbitrary recording or room.


2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2023-29032)

The vulnerability allows a remote user to escalate privileges within the application.

The vulnerability exists due to application does not properly impose security restrictions when handling invitation hashes. A remote user can gain unauthorized access to the application.


3) Code Injection (CVE-ID: CVE-2023-29246)

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation when handling null bytes. A remote privileged user can send a specially crafted request and execute arbitrary code on the target system.


Remediation

Install update from vendor's website.

References