VULNERABILITY INTELLIGENCE
CVE-2016-2164
CVSS score7.5 HIGH
EPSS probability7.01%
CISA KEVNot currently listed
Published2016-04-11
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor