CVE-2024-54676

Katalog CVE

CVSS 9.8 · Critical EPSS 64,9%

Kerentanan Deserialization of Untrusted Data pada apache openmeetings. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

Rincian

Terbit di NVD

8 Januari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

64,9% peluang dieksploitasi; lebih tinggi dari 99,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95 advisory vendor
• http://www.openwall.com/lists/oss-security/2025/01/08/1 mailing list