org.apache.openmeetings:openmeetings-parent (Maven)
Advisories
25
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 9.0.0 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.apache.openmeetings</groupId><artifactId>openmeetings-parent</artifactId><version>9.0.0</version></dependency>gradle
implementation("org.apache.openmeetings:openmeetings-parent:9.0.0")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-gcvm-c75m-h4p4 Apache OpenMeetings Uses GET Request Method With Sensitive Query Strings |
High EPSS 0.51% |
>= 3.1.3, < 9.0.0 | 9.0.0 |
| GHSA-wqxq-w68r-wg85 Apache OpenMeetings Uses Hard-coded Cryptographic Key |
High EPSS 0.30% |
>= 6.1.0, < 9.0.0 | 9.0.0 |
| GHSA-78cg-fc6c-w44w Apache OpenMeetings has an Improper Handling of Insufficient Privileges vulnerability |
Medium EPSS 0.42% |
>= 3.10, < 9.0.0 | 9.0.0 |
| GHSA-mjf9-4pcv-vfg7 Apache OpenMeetings vulnerable to Deserialization of Untrusted Data |
Critical EPSS 68.78% |
>= 2.1.0, < 8.0.0 | 8.0.0 |
| GHSA-mg5h-f3q8-c96g Apache OpenMeetings vulnerable to remote code execution via null-bye injection |
High EPSS 1.46% |
>= 2.0.0, < 7.1.0 | 7.1.0 |
| GHSA-v9rm-7rv9-r3fw Apache OpenMeetings Improper Authentication vulnerability |
High EPSS 1.09% |
>= 3.1.3, < 7.1.0 | 7.1.0 |
| GHSA-3r48-3m8r-4r9w Apache OpenMeetings missing authentication and can allow user impersonation |
Critical EPSS 1.26% |
>= 2.0.0, < 7.0.0 | 7.0.0 |
| GHSA-67q3-gwww-pm4g Apache OpenMeetings does not correctly validate uploaded XML documents |
Critical EPSS 2.35% |
>= 3.1.0, < 3.3.0 | 3.3.0 |
| GHSA-pxj9-mw96-q634 Apache OpenMeetings Cross-site Scripting vulnerability |
Medium EPSS 2.67% |
>= 3.2.0, < 3.3.0 | 3.3.0 |
| GHSA-335g-xcjh-ghc2 Apache OpenMeetings vulnerable to SQL injection |
High EPSS 1.29% |
>= 1.0.0, < 3.3.0 | 3.3.0 |
| GHSA-4v67-wg88-37p9 Apache OpenMeetings displays Tomcat version and detailed error stack trace |
High EPSS 2.00% |
>= 1.0.0, < 3.3.0 | 3.3.0 |
| GHSA-m5pm-rgvf-vg22 Apache OpenMeetings vulnerable to Cross-Site Request Forgery |
High EPSS 0.80% |
>= 1.0.0, < 3.3.0 | 3.3.0 |
| GHSA-f6vf-465r-h42p Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file |
High EPSS 7.01% |
< 3.1.1 | 3.1.1 |
| GHSA-gw38-mxr2-rm8r Apache OpenMeetings Cross-site Scripting vulnerability |
Medium EPSS 7.97% |
< 3.1.1 | 3.1.1 |
| GHSA-633w-w2pf-x84r Apache OpenMeetings Cross-site Scripting vulnerability |
Medium EPSS 4.86% |
< 3.1.2 | 3.1.2 |
| GHSA-6cpg-3w7f-j67q Apache OpenMeetings RCE |
Critical EPSS 4.78% |
< 3.1.2 | 3.1.2 |
| GHSA-cv9j-7q4x-v2g2 Apache OpenMeetings may allow authenticated attacker to deny service for privileged users |
Medium EPSS 1.08% |
>= 3.0.0, < 4.0.2 | 4.0.2 |
| GHSA-g3vq-f35v-vhgm Apache OpenMeetings vulnerable to Uncontrolled Resource Consumption |
High EPSS 2.81% |
>= 1.0.0, < 3.3.0 | 3.3.0 |
| GHSA-2c3p-9j5f-33g3 Apache OpenMeetings responds to insecure HTTP methods |
Medium EPSS 2.86% |
>= 1.0.0, < 3.3.0 | 3.3.0 |
| GHSA-xhj7-jr45-5w8r Apache OpenMeetings updates user password in insecure manner |
High EPSS 2.97% |
>= 1.0.0, < 3.3.0 | 3.3.0 |
| GHSA-2q65-xxg6-3qh5 Apache OpenMeetings vulnerable to parameter manipulation attacks |
High EPSS 1.64% |
>= 3.2.0, < 3.3.0 | 3.3.0 |
| GHSA-cqm6-hrgq-6869 Apache OpenMeetings has Inadequate Encryption Strength |
Critical EPSS 1.65% |
>= 1.0.0, < 3.3.0 | 3.3.0 |
| GHSA-q52r-g8jf-wv3x Apache OpenMeetings allows flash content to be loaded from untrusted domains |
High EPSS 1.81% |
>= 1.0.0, < 3.3.0 | 3.3.0 |
| GHSA-g37q-26qx-8v2m Denial of service in Apache OpenMeetings |
High EPSS 68.58% |
>= 4.0.0, < 5.1.0 | 5.1.0 |
| GHSA-px9f-597f-wmcf Uncontrolled Resource Consumption in Apache OpenMeetings server |
High EPSS 2.84% |
>= 4.0.0, < 6.0.0 | 6.0.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor