CVE-2021-27576 Apache OpenMeetings: bandwidth can be overloaded with public web service

What is CVE-2021-27576?

CVE-2021-27576 is a high-severity denial of service vulnerability in Apache OpenMeetings, published on 15 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0

Which versions are affected by CVE-2021-27576?

2 open source packages ship an affected version, including org.apache.openmeetings:openmeetings-parent. It affects 1 product.

Products include Apache Openmeetings.

How do I fix CVE-2021-27576?

Upgrade org.apache.openmeetings:openmeetings-parent to 6.0.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-27576 being exploited?

There is no known exploitation of CVE-2021-27576 in the wild and no public exploit code.

Other vulnerabilities in Apache OpenMeetings

• CVE-2017-7664 Apache OpenMeetings does not correctly validate uploaded XML documents Critical 10.0
• CVE-2024-54676 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode Critical 9.8
• CVE-2023-28326 Apache OpenMeetings: allows user impersonation Critical 9.8
• CVE-2016-8736 Apache OpenMeetings RCE Critical 9.8
• CVE-2017-7673 Apache OpenMeetings has Inadequate Encryption Strength Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-px9f-597f-wmcf.