CVE-2017-7673: apache software foundation apache openmeetings
CVSS: 9.8v3.0CriticalModified
AliasesGHSA-cqm6-hrgq-6869
Published 14-07-2017Last modified 05-08-2024
Vulnerability summary
CVE-2017-7673 is a critical (CVSS 9.8) vulnerability in apache software foundation apache openmeetings. EPSS estimates a 1.65% chance of exploitation in the next 30 days, higher than 76% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.0 (NVD)EPSS score
1.65%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 14-07-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.
CVSS metrics
3 scores · 2 sources · 2 versionsCritical 9.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated9.8CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
1.65%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
0.00 pp
From 1.65% on 18-09-2026
18-09-202618-10-2026
EPSS score1.65%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-307Improper Restriction of Excessive Authentication AttemptsThe product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Affected systems
Apache1 product
- openmeetings1.0.0 | 2.0 | 2.1 | 2.1.1 | 2.2.0 | 3.0.0 | 3.0.1 | 3.0.2 | 3.0.3 | 3.0.4 | 3.0.5 | 3.0.6 | 3.0.7 | 3.1.0 | 3.1.1 | 3.1.2 | 3.1.3 | 3.1.4 | 3.1.5 | 3.2.0 | 3.2.1
Apache software foundation1 product
- apache openmeetings1.0.0
Org.apache.openmeetings1 product
- openmeetings-parent≥ 1.0.0, < 3.3.0
3 vendors · 3 products
