CVE-2024-38273

moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

概要

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

影響パッケージ

Bitnami moodle

[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.11"},{"introduced":"4.2.0"},{"fixed":"4.2.8"},{"introduced":"4.3.0"},{"fixed":"4.3.5"},{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}]

参照URL

advisory moodle.org
web lists.fedoraproject.org
web lists.fedoraproject.org
web nvd.nist.gov