Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file

Description

References

• nvd.nist.gov/vuln/detail/CVE-2016-2164 · ADVISORY
• apache/openmeetings · PACKAGE
• apache.org/dist/openmeetings/3.1.1/CHANGELOG · WEB
• openmeetings.apache.org/security.html · WEB
• packetstormsecurity.com/files/136434/Apache-OpenMeetings-3.0.7-Arbitary-File-Read.html · WEB
• securityfocus.com/archive/1/537887/100/0/threaded

Weitere Schwachstellen in org.apache.openmeetings:openmeetings-parent

• CVE-2026-34020HOCH 7.5Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method w…
• CVE-2026-33266HOCH 7.5Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in …
• CVE-2026-33005MITTEL 4.3Improper Handling of Insufficient Privileges vulnerability in Apache OpenMeetings. Any registered user can query web service with their cre…
• CVE-2024-54676KRITISCH 9.8Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering inst…
• CVE-2023-29246HOCH 7.2An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versi…