CVE-2023-29246

EPSS 0.07%
Published 12.05.2023 08:15:08
Last modified 21.11.2024 07:56:45
Source security@apache.org
Teams watchlist Login
Open Login

An attacker who has gained access to an admin account can perform RCE via null-byte injection

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Apache ≫ Openmeetings Version >= 2.0.0 < 7.1.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.07%	0.206

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0	7.2	1.2	5.9	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://lists.apache.org/thread/230plvhbdx26m43b0sy942wlwt6kkmmr

Mailing List

https://nvd.nist.gov/vuln/detail/CVE-2023-29246

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-29246

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-29246

EUVD