CVE-2020-13951 Denial of service in Apache OpenMeetings

What is CVE-2020-13951?

CVE-2020-13951 is a high-severity denial of service vulnerability in Apache OpenMeetings, published on 30 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.

Which versions are affected by CVE-2020-13951?

2 open source packages ship an affected version, including org.apache.openmeetings:openmeetings-parent. It affects 1 product.

Products include Apache Openmeetings.

How do I fix CVE-2020-13951?

Upgrade org.apache.openmeetings:openmeetings-parent to 5.1.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-13951 being exploited?

There is no known exploitation of CVE-2020-13951 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Apache OpenMeetings

• CVE-2017-7664 Apache OpenMeetings does not correctly validate uploaded XML documents Critical 10.0
• CVE-2024-54676 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode Critical 9.8
• CVE-2023-28326 Apache OpenMeetings: allows user impersonation Critical 9.8
• CVE-2016-8736 Apache OpenMeetings RCE Critical 9.8
• CVE-2017-7673 Apache OpenMeetings has Inadequate Encryption Strength Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g37q-26qx-8v2m.