CVE-2024-38273CWE-284

moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Medium · published June 18, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
35.7
In the wild
Unconfirmed
What it is

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00425 · 35.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-06-18T19:49Z
EPSS history
Timeline
  • 18 JUN 19:49Z
    moodle: BigBlueButton web service leaks meeting joining information to users who should not have access
    cvelistv5