What is CVE-2024-54676?

CVE-2024-54676 is a critical-severity vulnerability in Apache Openmeetings, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-01-08.

How severe is CVE-2024-54676?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2024-54676 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Apache Openmeetings

CVE-2024-54676

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.

Vulnerability class: Insecure Deserialization

EPSS: 0.652 (99.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Openmeetings
Apache Software Foundation Openmeetings — versions 2.1

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

References

security@apache.org (vendor-advisory, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List)

Frequently asked questions

What is CVE-2024-54676?: CVE-2024-54676 is a critical-severity vulnerability in Apache Openmeetings, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2025-01-08.
How severe is CVE-2024-54676?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2024-54676 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.