Summary
Ein Angreifer kann mehrere Schwachstellen in BigBlueButton ausnutzen, um Daten zu manipulieren und Benutzer auf vom Angreifer kontrollierte Domains umzuleiten.
Product
BigBlueButton ist ein Open-Source-Web-Konferenzsystem.
Vulnerabilities 2
-
Medium 6.5
BigBlueButton's missing authorization allows viewer to inject/overwrite captions
BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have a missing authorization that allows viewers to inject/overwrite captions Version 3.0.24 tightened the permissions on who is able to submit captions. No known workarounds are avai…
-
Medium 4.3
BigBlueButton has Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL"
BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have an Open Redirect through bigbluebutton/api/join via get-parameter "logoutURL." Version 3.0.24 has adjusted the handling of requests with incorrect checksum so that the default lo…
Revision history
-
#2
CVE's ergänzt
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-cvwj-4pcp-f3g8 vom 2026-04-13
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-cvwj-4pcp-f3g8
-
GitHub Security Advisory GHSA-q387-2q28-mg33 vom 2026-04-13
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-q387-2q28-mg33