What is GHSA-f6vf-465r-h42p?

GHSA-f6vf-465r-h42p is a security advisory published by GitHub Security Advisories with High severity. Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

Which CVE IDs does GHSA-f6vf-465r-h42p cover?

GHSA-f6vf-465r-h42p covers the following CVE IDs: CVE-2016-2164. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f6vf-465r-h42p?

GHSA-f6vf-465r-h42p has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-f6vf-465r-h42p?

GHSA-f6vf-465r-h42p affects 1 product, including: maven/org.apache.openmeetings:openmeetings-parent:\u003c 3.1.1.

GHSA-f6vf-465r-h42pHighCVSS 7.5

Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

February 2, 2023

🔗 CVE IDs covered (1)

CVE-2016-2164 →

📋 Description

The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.

🎯 Affected products1

maven/org.apache.openmeetings:openmeetings-parent:< 3.1.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2016-2164
https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG
http://openmeetings.apache.org/security.html
http://packetstormsecurity.com/files/136434/Apache-OpenMeetings-3.0.7-Arbitary-File-Read.html
https://github.com/advisories/GHSA-f6vf-465r-h42p