CVE-2024-38518: bbb-web API additional parameters considered
First published: Fri Jun 28 2024(Updated: )
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an attacker to join a meeting as moderator using a join link that was originally created for viewer access. This vulnerability has been patched in version(s) 2.6.18, 2.7.8 and 3.0.0-alpha.7.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| BigBlueButton | <2.6.18<2.7.8<3.0.0-alpha.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4
- https://github.com/bigbluebutton/bigbluebutton/pull/20279
- https://github.com/bigbluebutton/bigbluebutton/commit/a9d436accdcd26ea66bed9f391488ac128cd62d1
- https://github.com/bigbluebutton/bigbluebutton/commit/ea6e9461dceae8fa593543d8c686f77bb8677e72
Frequently Asked Questions
What is the severity of CVE-2024-38518?
CVE-2024-38518 is a high severity vulnerability that allows an attacker to generate a signed join link with unauthorized parameters.
How do I fix CVE-2024-38518?
To fix CVE-2024-38518, users should update BigBlueButton to a version that is not affected, specifically beyond 2.6.18, 2.7.8, and 3.0.0-alpha.7.
Who is affected by CVE-2024-38518?
Users of BigBlueButton versions up to 2.6.18, 2.7.8, and 3.0.0-alpha.7 are at risk from CVE-2024-38518.
What type of attack can be executed with CVE-2024-38518?
CVE-2024-38518 can be exploited by an attacker to impersonate a moderator within a meeting by generating a manipulated join link.
What are the impacts of CVE-2024-38518?
The impacts of CVE-2024-38518 include potential unauthorized access to moderator privileges, which can lead to disruption of meetings and misuse of features.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/severity
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/bigbluebutton
- canonical/bigbluebutton