Read the docs
TI-2017-05317 Aliases CVE-2017-7681GHSA-335g-xcjh-ghc2

SQL injection in Apache OpenMeetings

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.

Why it matters now

EPSS 0.01285 70th percentileScored 2026-11-07
Fix Fixed org.apache.openmeetings:openmeetings-parent (Maven): 3.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache OpenMeetings1.0.0—No fix listedCNA
—org.apache.openmeetings:openmeetings-parent (Maven)1.0.0 to before 3.3.03.3.0Patch availableGHSA-335g-xcjh-ghc2
  • Apache OpenMeetings VendorApache Affected 1.0.0 Fixed in — No fix listed CNA
  • org.apache.openmeetings:openmeetings-parent (Maven) Vendor— Affected 1.0.0 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-335g-xcjh-ghc2

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:apache:openmeetings:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableApache
cpe:2.3:a:apache:openmeetings:2.0:*:*:*:*:*:*:*2.0VulnerableApache
cpe:2.3:a:apache:openmeetings:2.1:*:*:*:*:*:*:*2.1VulnerableApache
cpe:2.3:a:apache:openmeetings:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableApache
cpe:2.3:a:apache:openmeetings:2.2.0:*:*:*:*:*:*:*2.2.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.1:*:*:*:*:*:*:*3.0.1VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.2:*:*:*:*:*:*:*3.0.2VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.4:*:*:*:*:*:*:*3.0.4VulnerableApache
  • cpe:2.3:a:apache:openmeetings:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·Apache
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:openmeetings:3.0.5:*:*:*:*:*:*:*3.0.5VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.6:*:*:*:*:*:*:*3.0.6VulnerableApache
cpe:2.3:a:apache:openmeetings:3.0.7:*:*:*:*:*:*:*3.0.7VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableApache
cpe:2.3:a:apache:openmeetings:3.1.5:*:*:*:*:*:*:*3.1.5VulnerableApache
cpe:2.3:a:apache:openmeetings:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableApache
cpe:2.3:a:apache:openmeetings:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableApache
  • cpe:2.3:a:apache:openmeetings:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.1.5:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:openmeetings:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-335g-xcjh-ghc2 org.apache.openmeetings:openmeetings-parent (Maven) Fixed in 3.3.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7681
  2. 2026-10-03 Alias added: GHSA-335g-xcjh-ghc2

References

Advisory 2

Other 1

  • TI-2024-36639 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode CVSS 3.1CRITICAL 9.8
  • TI-2026-26346 Apache OpenMeetings: Login Credentials Passed via GET Query Parameters CVSS 3.1HIGH 7.5
  • TI-2020-10927 Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack. CVSS 3.1HIGH 7.5
  • TI-2016-00702 Directory traversal vulnerability in the Import/Export System Backups functionality in… CVSS 3.0MEDIUM 6.5
  • TI-2023-12874 Apache OpenMeetings: allows user impersonation CVSS 3.1CRITICAL 9.8
  • TI-2016-07193 Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. CVSS 3.0CRITICAL 9.8
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences