Summary
Ein Angreifer kann mehrere Schwachstellen in BigBlueButton ausnutzen, um falsche Informationen darzustellen, und um einen SQL-Injection Angriff durchzuführen.
Product
BigBlueButton ist ein Open-Source-Web-Konferenzsystem.
Vulnerabilities 2
-
High 8.5
BigBlueButton: Blind SQL Injection AUTH (Moderator)
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton allowed authenticated moderators to inject SQL through the meetingId and userId values used by refreshBreakoutRoomsVisibleForUsers in akka-bbb-apps/src/main/scala/org/bigbluebut…
-
High 7.1
BigBlueButton: Unauthenticated Session Hijack via Exposed /bigbluebutton/api/handleJoinExistingUser
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to su…
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-63680, EUVD-2026-63677
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-38fw-2gq7-ccgr vom 2026-06-04
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-38fw-2gq7-ccgr
-
GitHub Security Advisory GHSA-gfv2-46v4-jvw5 vom 2026-06-04
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-gfv2-46v4-jvw5