by Kastro
Paper/Archive/CVE-2024-54676

CVE-2024-54676

Apache Software Foundation Apache OpenMeetings — Apache OpenMeetings: Deserialisation of untrusted data in cluster mode

EPSS 69%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.3.993 × 2019.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

Affected

ProductAffectedFixed inSource
Apache OpenMeetings2.1 – < 8.0.08.0.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95refopenwall.com/lists/oss-security/2025/01/08/1