CVE-2024-54676

critical · 9.8

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

9.8

CVSS

64.9%

EPSS (exploit prob.)

99th

EPSS percentile

2025-01-08

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

Vendor	Product	Affected versions
apache	openmeetings	>= 2.1, < 8.0.0

Check a specific version with /api/v1/cve/match.

References

https://lists.apache.org/thread/o0k05jxrt5tp4nm45lj14yfjxmg67m95
http://www.openwall.com/lists/oss-security/2025/01/08/1

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-54676