Published: 11/04/2016 Updated: 09/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 6.1 | Impact Score: 2.7 | Exploitability Score: 2.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in Apache OpenMeetings prior to 3.1.1 allows remote malicious users to inject arbitrary web script or HTML via the event description when creating an event.

Vulnerable Product	Search on Vulmon	Subscribe to Product
apache openmeetings

Remote code execution found and fixed in Apache OpenMeetings

The Register • Darren Pauli • 07 Apr 2016

Password token snatch might explain that unexpected weirdo in your next online meeting

Recurity Labs hacker Andreas Lindh has found four vulnerabilities, including a remote code execution hole, in Apache OpenMeetings. The flaws mean attackers could hijack installations of the popular virtual meetings and shared whiteboard application. Lindh reported two critical flaws including a predictable password reset token (CVE-2016-0783) and an arbitrary file read through the SOAP API (CVE-2016-2164) along with moderately dangerous holes in ZIP file path traversal (CVE-2016-0784) and stored...

CVE-2016-2163

Vulnerability Summary

Recent Articles

References

Vulmon Search

About

Products

Connect