A critical information exposure vulnerability in Apache OpenMeetings allows for the potential interception of user credentials due to insecure transmission methods.

The application utilizes the HTTP GET method for its REST login endpoint, causing sensitive information such as usernames and passwords to be included in query strings, which are often logged in plain text. This vulnerability is accessible to unauthenticated attackers, as indicated by the CVSS vector AV:N/PR:N/UI:N.

The exposure of clear-text credentials during the authentication process poses a significant risk to organizational security. An attacker capable of monitoring network traffic or accessing server logs could intercept these credentials, leading to unauthorized account access and potential compromise of sensitive communication data. While the CVSS score of 7.5 reflects a high risk of information disclosure, the impact is compounded by the potential for lateral movement within the network.

Immediate Action: Upgrade Apache OpenMeetings to version 9.0.0 or later, which addresses the insecure use of the GET method for authentication.

Proactive Monitoring: Review web server and proxy access logs to identify any unusual patterns or attempts to access the REST API with sensitive parameters visible in the URL.

Compensating Controls: Deploy a Web Application Firewall (WAF) to monitor and block requests containing sensitive information in the query string, and ensure that transport layer security (TLS) is strictly enforced to minimize the risk of interception.

Public Exploit Available: No (Exploit_available: false).

Given the severity of credential exposure, administrators must prioritize the update to version 9.0.0. This flaw allows for the silent theft of authentication data, making immediate remediation essential to maintaining the integrity of user accounts and the privacy of the OpenMeetings platform.