Skip to content
OpenAdvisories
High · 7.2 CVE-2023-29246 EUVD-2023-1579GHSA-mg5h-f3q8-c96g

Apache OpenMeetings: allows null-byte Injection

Published May 12, 2023 · Updated Oct 10, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache OpenMeetings Package: org.apache.openmeetings:openmeetings-parent Ecosystem: Maven

Description

An attacker who has gained access to an admin account can perform RCE via null-byte injection

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache OpenMeetings 2.0.0 – < 7.1.0 7.1.0

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.openmeetings:openmeetings-parent >= 2.0.0, < 7.1.0 7.1.0 GHSA-mg5h-f3q8-c96g

References