org.apache.openmeetings:openmeetings-db@8.0.0

latest version

9.0.0

latest non vulnerable version

9.0.0

first published

9 years ago

latest version published

1 months ago

licenses detected

Apache-2.0
[3.1.2,)

package registry

View on Maven Central Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.openmeetings:openmeetings-db package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Improper Handling of Insufficient Privileges Affected versions of this package are vulnerable to Improper Handling of Insufficient Privileges via the `FileItemDTO` component. An attacker can access metadata of files and sub-folders in any folder, including id, type, name, and other fields, by sending authenticated web service queries with their credentials. How to fix Improper Handling of Insufficient Privileges? Upgrade `org.apache.openmeetings:openmeetings-db` to version 9.0.0 or higher.	[4.0.0,9.0.0)
H Use of Hard-coded Cryptographic Key Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key in the `remember-me` cookie encryption key and salt. An attacker can obtain full user credentials by stealing a cookie from a logged-in user if the default encryption key has not been changed. How to fix Use of Hard-coded Cryptographic Key? Upgrade `org.apache.openmeetings:openmeetings-db` to version 9.0.0 or higher.	[6.2.0,9.0.0)

Improper Handling of Insufficient Privileges

Affected versions of this package are vulnerable to Improper Handling of Insufficient Privileges via the FileItemDTO component. An attacker can access metadata of files and sub-folders in any folder, including id, type, name, and other fields, by sending authenticated web service queries with their credentials.

How to fix Improper Handling of Insufficient Privileges?

Upgrade org.apache.openmeetings:openmeetings-db to version 9.0.0 or higher.

[4.0.0,9.0.0)

Use of Hard-coded Cryptographic Key

Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key in the remember-me cookie encryption key and salt. An attacker can obtain full user credentials by stealing a cookie from a logged-in user if the default encryption key has not been changed.

How to fix Use of Hard-coded Cryptographic Key?

Upgrade org.apache.openmeetings:openmeetings-db to version 9.0.0 or higher.

[6.2.0,9.0.0)

Go back to all versions of this package