CVE-2024-38273: Moodle BigBlueButton web service leaks meeting joining information
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
Other sources
Moodle BigBlueButton web service leaks meeting joining information
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.2.8 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.3.5 - Upgrade
Upgrade
composer/moodle/moodleto a version that resolves this vulnerability.Fixed in 4.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38273?
CVE-2024-38273 has been rated as a high severity vulnerability due to insufficient capability checks.
How do I fix CVE-2024-38273?
To fix CVE-2024-38273, upgrade your Moodle installation to version 4.1.11, 4.2.8, 4.3.5, or 4.4.1.
What are the affected versions for CVE-2024-38273?
CVE-2024-38273 affects Moodle versions prior to 4.1.11, 4.2.8, 4.3.5, and 4.4.1.
Can users exploit CVE-2024-38273 remotely?
Yes, users can potentially exploit CVE-2024-38273 remotely to gain unauthorized access to BigBlueButton join URLs.
Who is at risk from CVE-2024-38273?
Organizations using affected versions of Moodle may be at risk from CVE-2024-38273 if they haven't applied the necessary updates.