Apache OpenMeetings GET Request Method Vulnerability Exposing Login Credentials

A vulnerability exists in Apache OpenMeetings versions 3.1.3 prior to 9.0.0, where the REST login endpoint improperly uses the HTTP GET method to transmit usernames and passwords as query parameters. This practice exposes sensitive information through various channels, including web logs and browser history, despite the use of HTTPS.

Impact

Exposing login credentials in query strings can lead to unauthorized access, as captured information may be stored in web logs or browser history. This vulnerability violates secure session management practices by exposing one-time passwords (OTPs) during their validity window, creating a risk of unauthorized account access.

Remediation

Users are advised to upgrade to Apache OpenMeetings version 9.0.0 or later, which addresses this vulnerability.