CyberRota Analysis
AI-GeneratedBigBlueButton versions prior to 3.0.29 are vulnerable to unauthorized deletion of presentations, as the system fails to verify the meeting identifier associated with a presentation before allowing its removal. This flaw enables a presenter to disrupt another meeting by deleting its presentation, potentially impacting the availability of educational content. Organizations using BigBlueButton should prioritize upgrading to version 3.0.29 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting. akka-bbb-apps/src/main/scala/org/bigbluebutton/core/apps/presentationpod/RemovePresentationPubMsgHdlr.scala did not verify the presentation's meeting identifier before deletion, allowing a presenter who knew the identifier to delete another meeting's presentation and disrupt its availability. This issue is fixed in version 3.0.29.