Alireza Gharib Blog

CVE-2024-54676 – Apache OpenMeetings Object Deserialization Vulnerability

CVE ID : CVE-2024-54676

Published : Jan. 8, 2025, 9:15 a.m. | 35 minutes ago

Description : Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0

Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn’t specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data.
Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant ‘openjpa.serialization.class.blacklist’ and ‘openjpa.serialization.class.whitelist’ configurations as shown in the documentation.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Go to Source

Tags: #cve, #cybersecurity, #security

Related Posts

Windows 11’s TPM 2.0: Free Software Foundation Fights Forced Upgrades and E-Waste Vulnerable Moxa devices expose industrial networks to attacks Vulnerability Overload: 40,000+ CVEs in 2024 Trio of Critical Vulnerabilities in Netis Routers Enables Unauthenticated RCE Top Cybersecurity Certifications to Boost Your Career in 2025 Thousands of SonicWall Devices Remain Vulnerable to CVE-2024-40766 TheCyberThrone Security Weekly Review – January 04, 2025 SonicWall waarschuwt voor actief misbruikt lek in SSLVPN-functie firewalls SonicWall urges admins to patch exploitable SSLVPN bug immediately SonicWall Issues Important Security Advisory for Multiple Vulnerabilities in SonicOS Secure Your Repos: go-git Patches Critical Vulnerability – CVE-2025-21613 (CVSS 9.8) Researchers Uncover Nuclei Vulnerability Enabling Signature Bypass and Code Execution Researchers Uncover Major Security Flaw in Illumina iSeq 100 DNA Sequencers Redis was affected by CVE-2024-51741 and CVE-2024-46981 Nuclei flaw lets malicious templates bypass signature verification Nuclei flaw bypasses template signature checks to execute commands New Mirai botnet targets industrial routers with zero-day exploits New EAGERBEE Variant Targets ISPs and Governments with Advanced Backdoor Capabilities MediaTek rings in the new year with a parade of chipset vulns Haunted — Blue Team Labs Online Write-up
, , , ,
, ,
Recent Posts