CVE-2016-2164

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

7.01%

Published

Apr 11, 2016

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.

Weaknesses (CWE)

CWE-200

Affected Products (1)

apache · openmeetingsvulnerable

References (8)

http://openmeetings.apache.org/security.html

PatchVendor Advisory

http://packetstormsecurity.com/files/136434/Apache-OpenMeetings-3.0.7-Arbitary-File-Read.html

http://www.securityfocus.com/archive/1/537887/100/0/threaded

https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG

http://openmeetings.apache.org/security.html

PatchVendor Advisory

http://packetstormsecurity.com/files/136434/Apache-OpenMeetings-3.0.7-Arbitary-File-Read.html

http://www.securityfocus.com/archive/1/537887/100/0/threaded

https://www.apache.org/dist/openmeetings/3.1.1/CHANGELOG

KEV Catalog EPSS Scores Vendors All CVEs