CVE-2024-38273

moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Bitnami moodle

[{"type":"SEMVER","events":[{"introduced":"4.1.0"},{"fixed":"4.1.11"},{"introduced":"4.2.0"},{"fixed":"4.2.8"},{"introduced":"4.3.0"},{"fixed":"4.3.5"},{"introduced":"4.4.0"},{"fixed":"4.4.1"}]}]

Références

advisory moodle.org
web lists.fedoraproject.org
web lists.fedoraproject.org
web nvd.nist.gov