PT-2024-28046 · Unknown · Bigbluebutton

Defnull · Published 2024-06-28 · Updated 2024-07-01 · CVE-2024-38518

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.6.18 BigBlueButton versions prior to 2.7.8 BigBlueButton versions prior to 3.0.0-alpha.7

Description BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters, such as role=moderator, allowing an attacker to join a meeting as moderator using a join link that was originally created for viewer access.

Recommendations For versions prior to 2.6.18, update to version 2.6.18 or later. For versions prior to 2.7.8, update to version 2.7.8 or later. For versions prior to 3.0.0-alpha.7, update to version 3.0.0-alpha.7 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-38518

GHSA-4M48-49H7-F3C4

Affected Products

Bigbluebutton

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38518.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-38518 · Security Note
• https://osv.dev/vulnerability/CVE-2024-38518 · Vendor Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4 · Note
• https://github.com/bigbluebutton/bigbluebutton/commit/a9d436accdcd26ea66bed9f391488ac128cd62d1 · Note
• https://github.com/bigbluebutton/bigbluebutton/commit/ea6e9461dceae8fa593543d8c686f77bb8677e72 · Note
• https://github.com/bigbluebutton/bigbluebutton/pull/20279 · Note
• https://t.me/cvenotify/84828 · Telegram Post