Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Apache OpenMeetings Public Web Service Abuse

CVE-2020-13951 · published 6 years ago
Summary

Attackers can use the public OpenMeetings web service to launch a denial of service attack, disrupting the availability of the application. This affects all users, making it harder to access the service. To protect your deployment, ensure the OpenMeetings public web service is not exposed to the internet or restrict access to it.

What to do
  • Update apache org.apache.openmeetings:openmeetings-parent to version 5.1.0.
Affected software
Ecosystem VendorProductAffected versions
maven apache org.apache.openmeetings:openmeetings-parent >= 4.0.0, < 5.1.0
Fix: upgrade to 5.1.0
– apache openmeetings >= 4.0.0, <= 5.0.0
cpe:2.3:a:apache:openmeetings:*:*:*:*:*:*:*:*
Original advisory text
Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
69% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published30 Sep 2020
Updated25 Sep 2026
First seen6 Mar 2026
Sources
GHSA-g37q-26qx-8v2m · GHSA
CVE-2020-13951 · NVD
Track software like this
Free during beta