{"id":"CVE-2023-28936","aliases":["EUVD-2023-2147","GHSA-v93h-rwj8-78qh"],"status":"published","title":"Apache OpenMeetings: insufficient check of invitation hash","description":"Attacker can access arbitrary recording/room\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01204,"percentile":0.68522,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-697"],"published":"2023-05-12T07:45:04Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"Maven","package":"org.apache.openmeetings:openmeetings-db","fixed_in":["7.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.openmeetings:openmeetings-db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"7.1.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.openmeetings:openmeetings-db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"7.1.0"}]}],"versions":["3.1.2","3.1.3","3.1.4","3.1.5","3.2.0","3.2.1","3.3.0","3.3.1","3.3.2","4.0.0","4.0.1","4.0.10","4.0.11","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.9","5.0.0","5.0.0-M1","5.0.0-M2","5.0.0-M3","5.0.0-M4","5.1.0","6.2.0","6.3.0","7.0.0"]}],"products":[{"vendor":"apache","product":"openmeetings"},{"vendor":"apache software foundation","product":"apache openmeetings"}],"references":[{"url":"https://lists.apache.org/thread/y6vng44c22ll221rtvsv208x1pbjmdoc","tags":["vendor-advisory","x_transferred","Mailing List","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28936","tags":["advisory"]},{"url":"https://github.com/apache/openmeetings/commit/a28dea888fca1c5c3e0ce4c8a4c62f501aebe0cd","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/OPENMEETINGS-2762","tags":["web"]},{"url":"https://github.com/advisories/GHSA-v93h-rwj8-78qh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28936.json","tags":["advisory"]},{"url":"https://github.com/apache/openmeetings","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-28936","title":"Apache OpenMeetings: insufficient check of invitation hash","description":"Attacker can access arbitrary recording/room\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0\n","status":"published","published":"2023-05-12T07:45:04.835Z","modified":"2024-10-10T20:30:03.38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-2147","description":"Attacker can access arbitrary recording/room\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0\n","status":"published","published":"2023-05-12T07:45:04Z","modified":"2024-10-10T20:30:03Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:27:39.67018Z"}],"ghsa":[{"id":"GHSA-v93h-rwj8-78qh","title":"Apache OpenMeetings insufficient authorization vulnerability","description":"Attacker can access arbitrary recording/room\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0\n","status":"published","published":"2023-07-06T21:14:56Z","modified":"2023-11-10T05:02:12Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:37:18.40412Z"}],"nvd":[{"id":"CVE-2023-28936","description":"Attacker can access arbitrary recording/room\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0\n","status":"published","published":"2023-05-12T08:15:08.857Z","modified":"2026-06-17T05:49:02.83Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:08:02.399327Z"}],"osv":[{"id":"CVE-2023-28936","title":"Apache OpenMeetings: insufficient check of invitation hash","description":"Attacker can access arbitrary recording/room\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0\n","status":"published","published":"2023-05-12T07:45:04.835Z","modified":"2026-10-28T02:30:38.594470581Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-v93h-rwj8-78qh","title":"Apache OpenMeetings insufficient authorization vulnerability","description":"Attacker can access arbitrary recording/room\n\nVendor: The Apache Software Foundation\n\nVersions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0\n","status":"published","published":"2023-07-06T21:14:56Z","modified":"2024-02-16T08:05:38.134257Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T15:46:56.981655Z"}]}}