Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in BigBlueButton ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.
Product
BigBlueButton ist ein Open-Source-Web-Konferenzsystem.
Vulnerabilities 2
-
Medium 4.6
bbb-web API additional parameters considered
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameter…
-
Low 3.7
Some bbb-record-core files installed with wrong file permission
BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the `/usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0` dir…
Revision history
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-4m48-49h7-f3c4 vom 2024-06-27
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4
-
GitHub Security Advisory GHSA-5966-9hw8-q96q vom 2024-06-27
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-5966-9hw8-q96q