CVE-2023-28936— Apache OpenMeetings: insufficient check of invitation hash
Quick assessment
Affected
Apache Software Foundation Apache OpenMeetings
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache OpenMeetings是美国阿帕奇（Apache）基金会的一套多语言可定制的视频会议和协作系统。该产品支持音频、视频并允许用户查看每个与会者的桌面等。 Apache OpenMeetings 2.0.0 到 7.1.0版本存在安全漏洞，攻击者可以访问任意录音或会议房间。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-28936
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache OpenMeetings: insufficient check of invitation hash
Source: CVE Program / CVE List V5
Vulnerability Description
Attacker can access arbitrary recording/room
Vendor: The Apache Software Foundation
Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的比较
Source: CVE Program / CVE List V5
Vulnerability Title
Apache OpenMeetings 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache OpenMeetings是美国阿帕奇（Apache）基金会的一套多语言可定制的视频会议和协作系统。该产品支持音频、视频并允许用户查看每个与会者的桌面等。 Apache OpenMeetings 2.0.0 到 7.1.0版本存在安全漏洞，攻击者可以访问任意录音或会议房间。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache OpenMeetings | 2.0.0 ~ 7.1.0 | - |
|
II. Public POCs for CVE-2023-28936
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-28936
请登录查看更多情报信息。
Mailing List Discussions for CVE-2023-28936 (1)
-
https://lists.apache.org/thread/y6vng44c22ll221rtvsv208x1pbjmdoc vendor-advisory
Same Patch Batch · Apache Software Foundation · 2023-05-12 · 3 CVEs total
| CVE-2023-29032 | Apache OpenMeetings: allows bypass authentication | |
| CVE-2023-29246 | Apache OpenMeetings: allows null-byte Injection |
IV. Related Vulnerabilities
Same product: Apache OpenMeetings
-
CVE-2026-49488
Apache OpenMeetings: Arbitrary File Read -
CVE-2026-33005
Apache OpenMeetings: Insufficient checks in FileWebService -
CVE-2026-33266
Apache OpenMeetings: Hardcoded Remember-Me Cookie Encryption -
CVE-2026-34020
Apache OpenMeetings: Login Credentials Passed via GET Query -
CVE-2024-54676
Apache OpenMeetings: Deserialisation of untrusted data in cl
Same vendor: Apache Software Foundation
-
CVE-2026-49845
Apache Hive: SQL Injection vulnerability in HiveMetaStore pa -
CVE-2026-55976
Apache Hive: SSRF vulnerability in Hive Avro Serde due to In -
CVE-2026-53561
Apache Hive: Unauthenticated authentication bypass in HiveSe -
CVE-2026-49050
Apache DolphinScheduler: General user can mint admin access -
CVE-2026-75099
Apache Allura: Unauthenticated REST disclosure
Same weakness: CWE-697
-
CVE-2026-73258
Mongoose: Multipart boundary/header scan logic error in mg_h -
CVE-2026-75110
MemOS Authentication Bypass via Unset INTERNAL_SERVICE_SECRE -
CVE-2026-50029
js-toml has silent type confusion via falsy-primitive duplic -
CVE-2026-67207
Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreContr -
CVE-2026-48032
Hulumi: IAM-role policy checks bypassed when the role trusts
V. Comments for CVE-2023-28936
No comments yet