Skip to content
OpenAdvisories
Medium WID-SEC-2023-2777 4 CVEs

BigBlueButton: Mehrere Schwachstellen

Published Oct 30, 2023 · Updated Oct 30, 2023 · de-DE

Platform: Linux

Summary

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in BigBlueButton ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder Dateien zu manipulieren.

Product

BigBlueButton ist ein Open-Source-Web-Konferenzsystem.

Vulnerabilities 4

  • Medium 6.3
    CVE-2023-43797

    BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby

    BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. …

    bigbluebutton bigbluebutton
  • Medium 5.6
    CVE-2023-43798

    BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)

    BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow r…

    bigbluebutton bigbluebutton
  • Medium 5.3
    CVE-2023-42803

    BigBlueButton Unrestricted File Upload vulnerability

    BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove …

    bigbluebutton bigbluebutton
  • Low 3.1
    CVE-2023-42804

    BigBlueButton Path Traversal – Reading Certain File Extensions

    BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with a valid starting folder path, to traverse and read other files without authentication, assuming the …

    bigbluebutton bigbluebutton

Revision history

  1. #1

    Initiale Fassung

References