Insecure HTTP Methods Vulnerability in Apache OpenMeetings Software
CVE-2017-7685

5.3MEDIUM

Key Information:

Vendor
Apache
Status
Apache Openmeetings
Vendor
CVE Published:
17 July 2017

Summary

The vulnerability in Apache OpenMeetings 1.0.0 arises from the software's inappropriate handling of certain HTTP methods, specifically PUT, DELETE, HEAD, and PATCH. This weakness allows attackers to potentially manipulate resources on the server, leading to unauthorized actions if not adequately secured. Understanding this vulnerability is crucial for safeguarding systems using this software.

Affected Version(s)

Apache OpenMeetings 1.0.0

References

http://markmail.org/message/uxk4bpq35svnyjhb
mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/99592
vdb-entryx_refsource_BID

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.