CVE-2024-54676

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95	Vendor Advisory
http://www.openwall.com/lists/oss-security/2025/01/08/1	Mailing List

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-01-08 09:15

Updated : 2025-01-15 15:50

NVD link : CVE-2024-54676

Mitre link : CVE-2024-54676

CVE.ORG link : CVE-2024-54676

JSON object : View

Products Affected

apache

openmeetings

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2024-54676", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-01-08T09:15:07.440", "references": [{"url": "https://lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2025/01/08/1", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "Vendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0\n\nDescription: Default clustering instructions at https://openmeetings.apache.org/Clustering.html \u00a0doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data.\nUsers are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation."}, {"lang": "es", "value": "Proveedor: The Apache Software Foundation Versiones afectadas: Apache OpenMeetings desde la versi\u00f3n 2.1.0 hasta la 8.0.0 Descripci\u00f3n: Las instrucciones de agrupamiento predeterminadas en https://openmeetings.apache.org/Clustering.html no especifican listas blancas/negras para OpenJPA, lo que lleva a una posible deserializaci\u00f3n de datos no confiables. Se recomienda a los usuarios actualizar a la versi\u00f3n 8.0.0 y actualizar sus scripts de inicio para incluir las configuraciones 'openjpa.serialization.class.blacklist' y 'openjpa.serialization.class.whitelist' relevantes como se muestra en la documentaci\u00f3n."}], "lastModified": "2025-01-15T15:50:39.987", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E83A3409-D9F1-4F24-AC6A-D97C68AC2344", "versionEndExcluding": "8.0.0", "versionStartIncluding": "2.1"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}