Users Granted Unauthorized Access to Join URLs Due to Insufficient Capability Checks
CVE-2024-38273

5.4MEDIUM

Key Information:

What is CVE-2024-38273?

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

Moodle 4.4

Moodle 4.3 <= 4.3.4

Moodle 4.2 <= 4.2.7

Score:

5.4

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet