BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation
概要
BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's Choices response type. By submitting a malicious payload with a massive array in the answerIds field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web youtube.com