PT-2023-28990 · Unknown · Bigbluebutton

Devme4Ff · Published 2023-10-30 · Updated 2023-11-08 · CVE-2023-43798

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.6.12 BigBlueButton versions prior to 2.7.0-rc.1

Description The issue is related to Server-Side Request Forgery (SSRF), which is a bypass of a previously known problem. A patch was applied to disable follow redirect at httpclient.execute since the software no longer has to follow it when using finalUrl. There are no known workarounds for this issue.

Recommendations For BigBlueButton versions prior to 2.6.12, upgrade to version 2.6.12 or later. For BigBlueButton versions prior to 2.7.0-rc.1, upgrade to version 2.7.0-rc.1 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-43798

GHSA-3Q22-HPH2-CFF7

GHSA-H98V-2H8W-99C4

Affected Products

Bigbluebutton

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43798.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-43798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43798 · Security Note
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7 · Note
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4 · Note
• https://github.com/bigbluebutton/bigbluebutton/pull/18580 · Note
• https://github.com/bigbluebutton/bigbluebutton/pull/18494 · Note
• https://t.me/cibsecurity/73198 · Telegram Post