Vulnerability · Published Oct 30, 2023 · Assigned by GitHub_M

CVE-2023-43798BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)

Medium 5.6

In plain English

A medium-severity server-side request forgery in bigbluebutton from bigbluebutton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)0.5%top 58.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at `httpclient.execute` since the software no longer has to follow it when using `finalUrl`. There are no known workarounds. We recommend upgrading to a patched version of BigBlueButton.

Affected products (as reported)

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< 2.6.12>= 2.7.0-alpha.1, < 2.7.0-rc.1

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4 x_refsource_CONFIRM
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/pull/18494 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/pull/18580 x_refsource_MISC