cvelistv5 - cve-2017-7681

cve-2017-7681

Vulnerability from cvelistv5

Published

2017-07-14 15:00

Modified

2024-09-16 18:39

Severity ?

Summary

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.

References

▼	URL	Tags
	security@apache.org	http://markmail.org/message/j774dp5ro5xmkmg6	Mailing List, Third Party Advisory
	af854a3a-2127-422b-91ae-364da2661108	http://markmail.org/message/j774dp5ro5xmkmg6	Mailing List, Third Party Advisory

Impacted products

Vendor

Product

Version

▼

Apache Software Foundation

Apache OpenMeetings

Version: 1.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:12:27.928Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[user] 20170713 CVE-2017-7681 - Apache OpenMeetings - SQL injection in web services",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://markmail.org/message/j774dp5ro5xmkmg6"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache OpenMeetings",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.0"
            }
          ]
        }
      ],
      "datePublic": "2017-07-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "SQL injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-14T14:57:01",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "name": "[user] 20170713 CVE-2017-7681 - Apache OpenMeetings - SQL injection in web services",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://markmail.org/message/j774dp5ro5xmkmg6"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2017-07-13T00:00:00",
          "ID": "CVE-2017-7681",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache OpenMeetings",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "SQL injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[user] 20170713 CVE-2017-7681 - Apache OpenMeetings - SQL injection in web services",
              "refsource": "MLIST",
              "url": "http://markmail.org/message/j774dp5ro5xmkmg6"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2017-7681",
    "datePublished": "2017-07-14T15:00:00Z",
    "dateReserved": "2017-04-11T00:00:00",
    "dateUpdated": "2024-09-16T18:39:15.972Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-7681\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2017-07-17T13:18:29.877\",\"lastModified\":\"2024-11-21T03:32:27.213\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.\"},{\"lang\":\"es\",\"value\":\"Apache OpenMeetings versi\u00f3n 1.0.0.0,  es vulnerable a la inyecci\u00f3n SQL. Esto permite a usuarios identificados modificar la estructura de la consulta existente y filtrar la estructura de otras consultas que est\u00e1n siendo realizadas por la aplicaci\u00f3n en el back-end.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72B6167B-E822-4146-87F2-E2769DC85F99\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CDA54EE-9AE1-4551-8C24-D2077515029C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AB137AFF-1BB8-4FFC-9247-376718AAFEB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:2.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4E8B4E9B-D707-4B96-93B0-7E5F19C8C9A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:2.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E44AAC6C-13E1-423B-BB4C-4C92B763DE34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"268D5F6C-F1E8-400B-8D79-A79A9481DFDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"57895052-DBEF-4CD4-B2B8-C6EBB7A607C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA80F112-8C3B-4D79-86A6-C7B3396C4DDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5AC28AE2-7EDD-4554-B418-7C4AD5D6E943\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"94BB2711-23CA-4FA5-8868-664A839F7EAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FCA799EE-CDF8-41C6-A3CF-5FC47ED0920C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96D13854-BD10-4404-89A7-F6D398680628\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EC465AB-5CA6-4C97-8544-59D3236A7123\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FCC94CB-EBC7-46D2-BD9E-DB043A4CD5B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC811824-EA8F-49F6-B732-10731A1BC0EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AFF29DC-46BA-4505-A921-42C783BC4C8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"085A80B3-B880-428D-AF1D-BED61C31E304\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"46036494-F97D-4C02-A630-102D9E7DE2CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2C208B6-E86A-4F73-B078-BA47BA1B162D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"331EDEB7-D823-43C6-9D8B-E872F921A328\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:openmeetings:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8D44A5F-C7BD-4CC2-9065-179FA92301C9\"}]}]}],\"references\":[{\"url\":\"http://markmail.org/message/j774dp5ro5xmkmg6\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://markmail.org/message/j774dp5ro5xmkmg6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2017-7681

Vulnerability from cvelistv5

gsd-2017-7681

Vulnerability from gsd

ghsa-335g-xcjh-ghc2

Vulnerability from github

Tags

Sightings

Nomenclature