CVE-2024-38273

moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Summary

Original description

The description as published by the source.

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami moodle

[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.11"},{"introduced":"4.2.0"},{"fixed":"4.2.8"},{"introduced":"4.3.0"},{"fixed":"4.3.5"},{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}]

References

advisory moodle.org
web lists.fedoraproject.org
web lists.fedoraproject.org
web nvd.nist.gov