Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-vfk3-wtbw-kuf9

Summary

Improper Authentication
An attacker that has gained access to certain private information can use this to act as other user.

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0

Aliases

alias	CVE-2023-29032

alias	GHSA-v9rm-7rv9-r3fw

Fixed_packages

url	pkg:maven/org.apache.openmeetings/openmeetings-parent@7.1.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-parent@7.1.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@7.1.0

url	pkg:maven/org.apache.openmeetings/openmeetings-server@7.1.0
purl	pkg:maven/org.apache.openmeetings/openmeetings-server@7.1.0
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-server@7.1.0

Affected_packages

url pkg:maven/org.apache.openmeetings/openmeetings-parent@3.1.3

purl pkg:maven/org.apache.openmeetings/openmeetings-parent@3.1.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-vfk3-wtbw-kuf9

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-parent@3.1.3

url pkg:maven/org.apache.openmeetings/openmeetings-server@3.1.3

purl pkg:maven/org.apache.openmeetings/openmeetings-server@3.1.3

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-vfk3-wtbw-kuf9

resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.openmeetings/openmeetings-server@3.1.3

References

reference_url	https://github.com/apache/openmeetings/commit/4e89e0ca076c83f26562f1146cf3e81ba0b16a7f
reference_id
reference_type
scores
url	https://github.com/apache/openmeetings/commit/4e89e0ca076c83f26562f1146cf3e81ba0b16a7f

reference_url	https://issues.apache.org/jira/browse/OPENMEETINGS-2764
reference_id
reference_type
scores
url	https://issues.apache.org/jira/browse/OPENMEETINGS-2764

reference_url	https://lists.apache.org/thread/j2d6mg3rzcphfd8vvvk09d8p4o9lvnqp
reference_id
reference_type
scores
url	https://lists.apache.org/thread/j2d6mg3rzcphfd8vvvk09d8p4o9lvnqp

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-29032
reference_id	CVE-2023-29032
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-29032

reference_url	https://github.com/advisories/GHSA-v9rm-7rv9-r3fw
reference_id	GHSA-v9rm-7rv9-r3fw
reference_type
scores
url	https://github.com/advisories/GHSA-v9rm-7rv9-r3fw

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	287
name	Improper Authentication
description	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-vfk3-wtbw-kuf9

Vulnerability Instance