CyberRota Analysis
AI-GeneratedBigBlueButton versions prior to 3.0.23 are vulnerable due to inadequate validation of presentation URLs, allowing unauthorized access to local addresses. This flaw could lead to exposure of sensitive information or unauthorized content sharing within virtual classrooms. Organizations using affected versions should prioritize upgrading to 3.0.23 to mitigate potential risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BigBlueButton is an open-source virtual classroom. Prior to 3.0.23, the presentation URL validation did not properly restrict access to site local and link local addresses. The redirect following logic now pins resolved IPs. This issue is fixed in version 3.0.23.