Moodle BigBlueButton web service leaks meeting joining information
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-38273US | — | — | ||
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/moodle/moodlePACKAGE
- https://github.com/moodle/moodle/commit/500cec575731fd8575569dcb5811535751dddae1WEB
- https://github.com/moodle/moodle/commit/647b9dc06409211018c9f28581504d096ce9e3a8WEB
- https://github.com/moodle/moodle/commit/6c0645ca29b195b5caaffc27d80f2ff715c33a48WEB
- https://github.com/moodle/moodle/commit/a10506b8d70609478fef156d489e0c7d727b6098WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/F7AZYR7EXV6E5SQE2GYTNQE3NOENJCQ6WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GHTIX55J4Q4LEOMLNEA4OZSWVEENQX7EWEB
- https://moodle.org/mod/forum/discuss.php?d=459498WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan