GHSA-gcvm-c75m-h4p4 CVE-2026-34020
Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.51%
- Chance of exploitation in the next 30 days. Higher than 43.45% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-598 Use of HTTP Request With Sensitive Query String
- Fix
9.0.0- Upgrade org.apache.openmeetings:openmeetings-parent to this version or later
Description
Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings.
The REST login endpoint uses HTTP GET method with username and password passed as query parameters. Please check references regarding possible impact
This issue affects Apache OpenMeetings: from 3.1.3 before 9.0.0.
Users are recommended to upgrade to version 9.0.0, which fixes the issue.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.apache.openmeetings:openmeetings-parent | >= 3.1.3, < 9.0.0 |
9.0.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.apache.openmeetings:openmeetings-parent Maven → 9.0.0
- maven
<dependency><groupId>org.apache.openmeetings</groupId><artifactId>openmeetings-parent</artifactId><version>9.0.0</version></dependency>- gradle
implementation("org.apache.openmeetings:openmeetings-parent:9.0.0")
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-598: Use of HTTP Request With Sensitive Query String
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
How to prevent it
- Implementation: When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-wqxq-w68r-wg85 Apache OpenMeetings Uses Hard-coded Cryptographic Key | High | Also affects org.apache.openmeetings:openmeetings-parent |
| GHSA-78cg-fc6c-w44w Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability | Medium | Also affects org.apache.openmeetings:openmeetings-parent |
| GHSA-mjf9-4pcv-vfg7 Apache OpenMeetings vulnerable to Deserialization of Untrusted Data | Critical | Also affects org.apache.openmeetings:openmeetings-parent |
| GHSA-mg5h-f3q8-c96g Apache OpenMeetings vulnerable to remote code execution via null-bye injection | High | Also affects org.apache.openmeetings:openmeetings-parent |
| GHSA-v9rm-7rv9-r3fw Apache OpenMeetings Improper Authentication vulnerability | High | Also affects org.apache.openmeetings:openmeetings-parent |
| GHSA-3r48-3m8r-4r9w Apache OpenMeetings missing authentication and can allow user impersonation | Critical | Also affects org.apache.openmeetings:openmeetings-parent |
| GHSA-pxj9-mw96-q634 Apache OpenMeetings Cross-site Scripting vulnerability | Medium | Also affects org.apache.openmeetings:openmeetings-parent |
| GHSA-m5pm-rgvf-vg22 Apache OpenMeetings vulnerable to Cross-Site Request Forgery | High | Also affects org.apache.openmeetings:openmeetings-parent |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor