cbcvebase.
CVE-2024-38273
published 2024-06-18

CVE-2024-38273: Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

PriorityP428medium5.4CVSS 3.1
AVNACLPRLUINSUCLINAL
EPSS
0.43%
35.0th percentile
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

Affected

14 ranges
VendorProductVersion rangeFixed in
fedoraprojectfedora——
fedoraprojectfedora——
moodlemoodle——
moodlemoodle——
moodlemoodle>= 0 < 4.1.114.1.11
moodlemoodle4.1 – 4.1.10—
moodlemoodle>= 4.1.0 < 4.1.114.1.11
moodlemoodle4.2 – 4.2.7—
moodlemoodle>= 4.2.0 < 4.2.84.2.8
moodlemoodle>= 4.2.0-beta < 4.2.84.2.8
moodlemoodle4.3 – 4.3.4—
moodlemoodle>= 4.3.0 < 4.3.54.3.5
moodlemoodle>= 4.3.0-beta < 4.3.54.3.5
moodlemoodle>= 4.4.0-beta < 4.4.14.4.1

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
osv5.4MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.