Apache OpenMeetings vulnerable to Deserialization of Untrusted Data
Date: 2025-01
Affected: maven/org.apache.openmeetings:openmeetings-parent
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2024-54676
CWE: CWE-502

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.


Mitigations:

Architectural layers (MAESTRO):