Read the docs
TI-2017-05309 Aliases CVE-2017-7673GHSA-cqm6-hrgq-6869

Missing brute-force protection in Apache OpenMeetings

Priority MEDIUM 45CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-307 and CWE-326.

Summary

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.

Why it matters now

EPSS 0.01647 76th percentileScored 2026-11-07
Fix Fixed org.apache.openmeetings:openmeetings-parent (Maven): 3.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache OpenMeetings1.0.0—No fix listedCNA
—org.apache.openmeetings:openmeetings-parent (Maven)1.0.0 to before 3.3.03.3.0Patch availableGHSA-cqm6-hrgq-6869
  • Apache OpenMeetings VendorApache Affected 1.0.0 Fixed in — No fix listed CNA
  • org.apache.openmeetings:openmeetings-parent (Maven) Vendor— Affected 1.0.0 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-cqm6-hrgq-6869

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:apache:openmeetings:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:openmeetings:2.0:*:*:*:*:*:*:*2.0VulnerableApache
cpe:2.3:a:apache:openmeetings:2.1:*:*:*:*:*:*:*2.1VulnerableApache
cpe:2.3:a:apache:openmeetings:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableApache
cpe:2.3:a:apache:openmeetings:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableApache
  • cpe:2.3:a:apache:openmeetings:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Apache
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:openmeetings:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.5:*:*:*:*:*:*:*3.1.5VulnerableApache
cpe:2.3:a:apache:openmeetings:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableApache
  • cpe:2.3:a:apache:openmeetings:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.5:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-cqm6-hrgq-6869 org.apache.openmeetings:openmeetings-parent (Maven) Fixed in 3.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7673
  2. 2026-10-03 Alias added: GHSA-cqm6-hrgq-6869

References

Advisory 2

Other 1

  • TI-2024-36639 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode CVSS 3.1CRITICAL 9.8
  • TI-2026-26346 Apache OpenMeetings: Login Credentials Passed via GET Query Parameters CVSS 3.1HIGH 7.5
  • TI-2020-10927 Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack. CVSS 3.1HIGH 7.5
  • TI-2016-00702 Directory traversal vulnerability in the Import/Export System Backups functionality in… CVSS 3.0MEDIUM 6.5
  • TI-2023-12874 Apache OpenMeetings: allows user impersonation CVSS 3.1CRITICAL 9.8
  • TI-2016-07193 Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences