Apache OpenMeetings may allow authenticated attacker to deny service for privileged users
Moderate severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Feb 2, 2023
Package
Affected versions
>= 3.0.0, < 4.0.2
Patched versions
4.0.2
Description
Published by the National Vulnerability Database
Feb 28, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Nov 22, 2022
Last updated
Feb 2, 2023
In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users. The issue is fixed in version 4.0.2.
References