Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.openmeetings:openmeetings-parent

25 known vulnerabilities (2 critical, 4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
9.1.0 (Jul 13, 2026): no advisory affects it
Newest unaffected release
9.1.0 (Jul 13, 2026), the latest release
Advisories
25 · 2 critical, 4 high, 1 medium
Dependents
0
Releases
33 since 3.1.2 (Aug 15, 2016)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

Show all 25 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 25

  • CVE-2026-33005Medium 4.3

    Apache OpenMeetings: Insufficient checks in FileWebService

    Affected: from 3.10, fixed in 9.0.0.

    Fixed in 9.0.0 (released Apr 5, 2026, 4 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption Key and Salt

    Affected: from 6.1.0, fixed in 9.0.0.

    Fixed in 9.0.0 (released Apr 5, 2026, 4 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings: Login Credentials Passed via GET Query Parameters

    Affected: from 3.1.3, fixed in 9.0.0.

    Fixed in 9.0.0 (released Apr 5, 2026, 4 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • CVE-2024-54676Critical 9.8

    Apache OpenMeetings: Deserialisation of untrusted data in cluster mode

    Affected: from 2.1.0, fixed in 8.0.0.

    Fixed in 8.0.0 (released Dec 29, 2024, 10 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings: allows bypass authentication

    Affected: from 3.1.3, fixed in 7.1.0.

    Fixed in 7.2.0 (released Dec 19, 2023, 221 days after disclosure, the advisory names 7.1.0, which was never published).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings: allows null-byte Injection

    Affected: from 2.0.0, fixed in 7.1.0.

    Fixed in 7.2.0 (released Dec 19, 2023, 221 days after disclosure, the advisory names 7.1.0, which was never published).

    The latest release, 9.1.0, is not affected.

  • CVE-2023-28326Critical 9.8

    Apache OpenMeetings: allows user impersonation

    Affected: from 2.0.0, fixed in 7.0.0.

    Fixed in 7.0.0 (released Feb 7, 2023, 49 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings: bandwidth can be overloaded with public web service

    Affected: from 4.0.0, fixed in 6.0.0.

    Fixed in 6.2.0 (released Apr 27, 2022, 408 days after disclosure, the advisory names 6.0.0, which was never published).

    The latest release, 9.1.0, is not affected.

  • Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.

    Affected: from 4.0.0, fixed in 5.1.0.

    Fixed in 5.1.0 (released Dec 1, 2020, 62 days after disclosure).

    The latest release, 9.1.0, is not affected.

  • In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to…

    Affected: from 3.0.0, fixed in 4.0.2.

    Fixed in 4.0.3 (released Apr 14, 2018, 45 days after disclosure, the advisory names 4.0.2, which was never published).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.

    Affected: fixed in 3.1.2.

    Fixed in 3.1.2 (released Aug 15, 2016, 423 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings 1.0.0 updates user password in insecure manner.

    Affected: from 1.0.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.

    Affected: from 1.0.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded.

    Affected: from 1.0.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.

    Affected: from 1.0.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

Show all 25 advisoriesShow fewer advisories

  • Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.

    Affected: from 3.2.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings 1.0.0 is vulnerable to SQL injection.

    Affected: from 1.0.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file.

    Affected: from 1.0.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and…

    Affected: from 1.0.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.

    Affected: from 1.0.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.

    Affected: from 3.1.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.

    Affected: from 3.2.0, fixed in 3.3.0.

    Fixed in 3.3.0 (released Jul 6, 2017, 8 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary…

    Affected: fixed in 3.1.2.

    Fixed in 3.1.2 (released Aug 15, 2016, 4 days before disclosure).

    The latest release, 9.1.0, is not affected.

  • The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1…

    Affected: fixed in 3.1.1.

    Fixed in 3.1.2 (released Aug 15, 2016, 126 days after disclosure, the advisory names 3.1.1, which was never published).

    The latest release, 9.1.0, is not affected.

  • Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or…

    Affected: fixed in 3.1.1.

    Fixed in 3.1.2 (released Aug 15, 2016, 126 days after disclosure, the advisory names 3.1.1, which was never published).

    The latest release, 9.1.0, is not affected.