Skip to content
CVE PROGRAM SOURCE RECORD5.4 Medium

CVE-2024-38273

moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
fedora

Description

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Moodle Moodle

Default version status: unaffected

  • 4.4affected
  • 4.3 to ≤ 4.3.4affected
  • 4.2 to ≤ 4.2.7affected
  • 4.1 to ≤ 4.1.10affected

References