Users Granted Unauthorized Access to Join URLs Due to Insufficient Capability Checks
CVE-2024-38273
5.4MEDIUM
Summary
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
Affected Version(s)
Moodle 4.4
Moodle 4.3 <= 4.3.4
Moodle 4.2 <= 4.2.7
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved