CVE-2024-54676

Apache OpenMeetings versions 2.1.0 through versions before 8.0.0 are vulnerable to deserialization of untrusted data (CWE-502) because the project's default clustering instructions do not configure OpenJPA serialization class blacklists or whitelists. In deployments that enable clustering following the published default setup, an attacker who can reach the clustered OpenMeetings service over the network can supply a crafted serialized Java object that the server deserializes without validation. Consistent with the CVSS 3.1 critical score of 9.8 (network vector, no privileges or user interaction required, high confidentiality/integrity/availability impact), successful exploitation could enable unauthenticated remote code execution and full system compromise. Only installations running affected versions with clustering enabled are exposed; standalone deployments without clustering are less likely to be impacted. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 65.2% probability of exploitation within 30 days (99th percentile), so defenders should treat this as likely to be exploited soon.

What to do: Upgrade to Apache OpenMeetings 8.0.0 or later and, as part of the upgrade, add the documented 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' settings to startup scripts, since upgrading alone is not sufficient. Organizations that cannot upgrade immediately should apply equivalent OpenJPA serialization filters or restrict network access to clustered OpenMeetings endpoints. Given the high EPSS score, prioritize patching of internet-exposed instances and monitor Apache security channels for signs of exploitation.