Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:maven/org.apache.openmeetings/openmeetings-parent@3.0.0

Type maven

Namespace org.apache.openmeetings

Name openmeetings-parent

Version 3.0.0

Qualifiers

Subpath

Is_vulnerable true

Next_non_vulnerable_version 3.1.2

Latest_non_vulnerable_version 7.1.0

Affected_by_vulnerabilities

url VCID-33h6-dtvw-kudy

vulnerability_id VCID-33h6-dtvw-kudy

summary

Overly Permissive Cross-domain Whitelist
Apache OpenMeetings has an overly permissive `crossdomain.xml` file. This allows for flash content to be loaded from untrusted domains.

references

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-7680
reference_id	CVE-2017-7680
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-7680

fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0

aliases CVE-2017-7680

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-33h6-dtvw-kudy

url VCID-4kqb-69nx-ffgr

vulnerability_id VCID-4kqb-69nx-ffgr

summary

Information Exposure
Apache OpenMeetings displays Tomcat version and detailed error stack trace.

references

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-7683
reference_id	CVE-2017-7683
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-7683

fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0

aliases CVE-2017-7683

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4kqb-69nx-ffgr

url VCID-73d7-xcav-67h3

vulnerability_id VCID-73d7-xcav-67h3

summary

Cleartext Storage of Sensitive Information
Apache OpenMeetings updates user password in insecure manner.

references

reference_url	http://www.securityfocus.com/bid/99586
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/99586

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-7688
reference_id	CVE-2017-7688
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-7688

fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0

aliases CVE-2017-7688

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-73d7-xcav-67h3

url VCID-7cjy-cp47-gfdj

vulnerability_id VCID-7cjy-cp47-gfdj

summary

Improper Authentication
In Apache OpenMeetings, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users.

references

reference_url	https://lists.apache.org/thread.html/dc2151baa5301bae773603cede0d62c21ee28588dd06e5e9253c13a8@%3Cuser.openmeetings.apache.org%3E
reference_id
reference_type
scores
url	https://lists.apache.org/thread.html/dc2151baa5301bae773603cede0d62c21ee28588dd06e5e9253c13a8@%3Cuser.openmeetings.apache.org%3E

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2018-1286
reference_id	CVE-2018-1286
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2018-1286

fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@4.0.3
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@4.0.3
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@4.0.3

aliases CVE-2018-1286

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7cjy-cp47-gfdj

url VCID-7tkn-ptbs-ruhn

vulnerability_id VCID-7tkn-ptbs-ruhn

summary

Trusting HTTP Permission Methods on the Server Side
Apache OpenMeetings responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.

references

reference_url	http://www.securityfocus.com/bid/99592
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/99592

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-7685
reference_id	CVE-2017-7685
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-7685

fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0

aliases CVE-2017-7685

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7tkn-ptbs-ruhn

url VCID-cy2v-sp7y-guba

vulnerability_id VCID-cy2v-sp7y-guba

summary

Improper Restriction of Excessive Authentication Attempts
Apache OpenMeetings uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.

references

reference_url	http://www.securityfocus.com/bid/99587
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/99587

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-7673
reference_id	CVE-2017-7673
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-7673

fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0

aliases CVE-2017-7673

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cy2v-sp7y-guba

url VCID-g2md-yap1-pkhe

vulnerability_id VCID-g2md-yap1-pkhe

summary

Uncontrolled Resource Consumption
Apache OpenMeetings does not check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server.

references

reference_url	http://www.securityfocus.com/bid/99584
reference_id
reference_type
scores
url	http://www.securityfocus.com/bid/99584

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-7684
reference_id	CVE-2017-7684
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-7684

fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0

aliases CVE-2017-7684

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-g2md-yap1-pkhe

url VCID-gpv8-hbup-pudv

vulnerability_id VCID-gpv8-hbup-pudv

summary Apache OpenMeetings is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.

references

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-7666
reference_id	CVE-2017-7666
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-7666

fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0

aliases CVE-2017-7666

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-gpv8-hbup-pudv

url VCID-sv6x-344a-uucy

vulnerability_id VCID-sv6x-344a-uucy

summary

SQL Injection
Apache OpenMeetings is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.

references

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2017-7681
reference_id	CVE-2017-7681
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2017-7681

fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.3.0

aliases CVE-2017-7681

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-sv6x-344a-uucy

Fixing_vulnerabilities

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.0.0

Package Instance