Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Apache OpenMeetings: Unrestricted File Upload via SOAP API

CVE-2016-2164 · published 10 years ago
Summary

Apache OpenMeetings users are at risk of file access compromise if an attacker can trick the system into uploading a malicious file. This could be done through the SOAP API. To fix, update to version 3.1.1 or later.

What to do
  • Update apache org.apache.openmeetings:openmeetings-parent to version 3.1.1.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.openmeetings:openmeetings-parent < 3.1.1
Fix: upgrade to 3.1.1
– apache openmeetings <= 3.1.0
cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*
Original advisory text
The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified p...
The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
7% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published11 Apr 2016
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-f6vf-465r-h42p · GHSA
CVE-2016-2164 · NVD
Track software like this
Free during beta