Read the docs
TI-2017-05316 Aliases CVE-2017-7680GHSA-q52r-g8jf-wv3x

Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file.

Priority LOW 36Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.

Why it matters now

EPSS 0.01807 78th percentileScored 2026-11-07
Fix Fixed org.apache.openmeetings:openmeetings-parent (Maven): 3.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache OpenMeetings1.0.0—No fix listedCNA
—org.apache.openmeetings:openmeetings-parent (Maven)1.0.0 to before 3.3.03.3.0Patch availableGHSA-q52r-g8jf-wv3x
  • Apache OpenMeetings VendorApache Affected 1.0.0 Fixed in — No fix listed CNA
  • org.apache.openmeetings:openmeetings-parent (Maven) Vendor— Affected 1.0.0 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-q52r-g8jf-wv3x

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:apache:openmeetings:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:openmeetings:2.0:*:*:*:*:*:*:*2.0VulnerableApache
cpe:2.3:a:apache:openmeetings:2.1:*:*:*:*:*:*:*2.1VulnerableApache
cpe:2.3:a:apache:openmeetings:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableApache
cpe:2.3:a:apache:openmeetings:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableApache
  • cpe:2.3:a:apache:openmeetings:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Apache
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:openmeetings:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.5:*:*:*:*:*:*:*3.1.5VulnerableApache
cpe:2.3:a:apache:openmeetings:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableApache
  • cpe:2.3:a:apache:openmeetings:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.5:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-q52r-g8jf-wv3x org.apache.openmeetings:openmeetings-parent (Maven) Fixed in 3.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7680
  2. 2026-10-03 Alias added: GHSA-q52r-g8jf-wv3x

References

Advisory 2

Other 1

  • TI-2024-36639 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode CVSS 3.1CRITICAL 9.8
  • TI-2026-26346 Apache OpenMeetings: Login Credentials Passed via GET Query Parameters CVSS 3.1HIGH 7.5
  • TI-2020-10927 Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack. CVSS 3.1HIGH 7.5
  • TI-2016-00702 Directory traversal vulnerability in the Import/Export System Backups functionality in… CVSS 3.0MEDIUM 6.5
  • TI-2023-12874 Apache OpenMeetings: allows user impersonation CVSS 3.1CRITICAL 9.8
  • TI-2016-07193 Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences