CyberRota Analysis
AI-GeneratedBigBlueButton versions prior to 3.0.23 are vulnerable to session hijacking, allowing an attacker to impersonate an active participant by supplying their existingUserID through an exposed API endpoint. This vulnerability poses a significant risk to the integrity of virtual classroom sessions, as it can lead to unauthorized access and potential disruption of meetings. Organizations using BigBlueButton should prioritize upgrading to version 3.0.23 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, BigBlueButton exposed /bigbluebutton/api/handleJoinExistingUser through bigbluebutton-web/grails-app/controllers/org/bigbluebutton/web/controllers/ApiController.groovy. A requester able to supply an existingUserID for an active participant could reuse that participant's session and impersonate the participant in the same meeting because handleJoinExistingUser was a routable controller action rather than a private helper. This issue is fixed in version 3.0.23.