Vulnerability · Published Jun 28, 2024 · Assigned by GitHub_M

CVE-2024-38518bbb-web API additional parameters considered

Medium 4.6

In plain English

A medium-severity improper access control in bigbluebutton from bigbluebutton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.3%top 76.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an attacker to join a meeting as moderator using a join link that was originally created for viewer access. This vulnerability has been patched in version(s) 2.6.18, 2.7.8 and 3.0.0-alpha.7.

Affected products (as reported)

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< 2.6.18>= 2.7.0, < 2.7.8>= 2.8.0, < 3.0.0-alpha.7

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

References

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4 x_refsource_CONFIRM
https://github.com/bigbluebutton/bigbluebutton/pull/20279 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/commit/a9d436accdcd26ea66bed9f391488ac128cd62d1 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/commit/ea6e9461dceae8fa593543d8c686f77bb8677e72 x_refsource_MISC