Read the docs
TI-2024-36639 Aliases CVE-2024-54676GHSA-mjf9-4pcv-vfg7

Apache OpenMeetings: Deserialisation of untrusted data in cluster mode

Priority CRITICAL 86CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.68777 99th percentileScored 2026-11-07
Fix Fixed Apache OpenMeetings (Apache Software Foundation): 8.0.0org.apache.openmeetings:openmeetings-parent (Maven): 8.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache OpenMeetings2.1 to before 8.0.08.0.0Patch availableCNA
—org.apache.openmeetings:openmeetings-parent (Maven)2.1.0 to before 8.0.08.0.0Patch availableGHSA-mjf9-4pcv-vfg7
  • Apache OpenMeetings VendorApache Affected 2.1 to before 8.0.0 Fixed in 8.0.0 Patch available CNA
  • org.apache.openmeetings:openmeetings-parent (Maven) Vendor— Affected 2.1.0 to before 8.0.0 Fixed in 8.0.0 Patch available GHSA-mjf9-4pcv-vfg7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*2.1 to before 8.0.0VulnerableApache
  • cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:* Versions 2.1 to before 8.0.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache OpenMeetings (Apache Software Foundation) Fixed in 8.0.0
  • Fix · GHSA-mjf9-4pcv-vfg7 org.apache.openmeetings:openmeetings-parent (Maven) Fixed in 8.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-54676
  2. 2026-10-03 Alias added: GHSA-mjf9-4pcv-vfg7

References

Advisory 2

Other 4

  • TI-2026-26346 Apache OpenMeetings: Login Credentials Passed via GET Query Parameters CVSS 3.1HIGH 7.5
  • TI-2020-10927 Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack. CVSS 3.1HIGH 7.5
  • TI-2016-00702 Directory traversal vulnerability in the Import/Export System Backups functionality in… CVSS 3.0MEDIUM 6.5
  • TI-2023-12874 Apache OpenMeetings: allows user impersonation CVSS 3.1CRITICAL 9.8
  • TI-2016-07193 Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack. CVSS 3.0CRITICAL 9.8
  • TI-2017-05300 Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0. CVSS 3.0CRITICAL 10.0
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences