CVE-2024-38273: Moodle BigBlueButton web service leaks meeting joining information
Summary
CVE-2024-38273: Moodle BigBlueButton web service leaks meeting joining information. Affects moodle/moodle across 4 version ranges.
< 4.1.11
>= 4.2.0-beta, < 4.2.8
>= 4.3.0-beta, < 4.3.5
>= 4.4.0-beta, < 4.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- moodle · Bitnami
The same CVE-2024-38273 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moodle is an open-source learning management system used by educational institutions to create and manage online courses. It provides various features for instructors and students to interact and collaborate. BigBlueButton is a web conferencing system integrated with Moodle, allowing users to conduct virtual meetings and webinars. This vulnerability in the Moodle BigBlueButton web service allows unauthorized users to access join URLs for meetings they do not have permission to attend.
Vulnerability Detail
Insufficient capability checks in the Moodle BigBlueButton web service enable users to gain access to BigBlueButton join URLs without proper authorization. This means that users can join meetings they are not supposed to attend, potentially compromising the privacy and security of those meetings. The vulnerability affects versions 4.1.11, 4.2.8, 4.3.5, and 4.4.1 of the Moodle package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.114.1.11composer require moodle/moodle:4.1.11 -
>= 4.2.0-beta, < 4.2.84.2.8composer require moodle/moodle:4.2.8 -
>= 4.3.0-beta, < 4.3.54.3.5composer require moodle/moodle:4.3.5 -
>= 4.4.0-beta, < 4.4.14.4.1composer require moodle/moodle:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of the Moodle package.
Conclusion
The Moodle BigBlueButton web service vulnerability allows unauthorized access to meeting join URLs, posing a risk to the privacy and security of virtual meetings. It is crucial to upgrade to the patched versions of the Moodle package to mitigate this vulnerability. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moodle/moodle →
FAQ
Moodle is an open-source learning management system used for creating and managing online courses.
BigBlueButton is a web conferencing system integrated with Moodle, allowing users to conduct virtual meetings and webinars.
This vulnerability allows unauthorized users to access BigBlueButton join URLs for meetings they do not have permission to attend, compromising the privacy and security of those meetings.
Versions 4.1.11, 4.2.8, 4.3.5, and 4.4.1 of the Moodle package are affected.
To fix this vulnerability, upgrade to Moodle 4.1.12, 4.2.9, 4.3.6, or 4.4.2, which include the necessary capability checks to prevent unauthorized access to BigBlueButton join URLs.
References
Related vulnerabilities
Recent vulnerabilities recorded for moodle/moodle.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
