CVE-2023-42803CWE-434

BigBlueButton Unrestricted File Upload vulnerability

Medium · published October 30, 2023

CVSS v3.1
5.3
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures. BigBlueButton 2.6.0-beta.2 contains a patch. There are no known workarounds.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00538 · 44.5th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2023-10-30T18:11Z
EPSS history
Timeline
  • 30 OCT 18:11Z
    BigBlueButton Unrestricted File Upload vulnerability
    cvelistv5