CVE-2023-43798

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at `httpclient.execute` since the software no longer has to follow it when using `finalUrl`. There are no known workarounds. We recommend upgrading to a patched version of BigBlueButton.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< 2.6.12; >= 2.7.0-alpha.1, < 2.7.0-rc.1

References

https://github.com/bigbluebutton/bigbluebutton/pull/18494Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/18580Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/18494Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/18580Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4Third Party Advisory

Timeline

Published: Oct 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-437997.8Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before pas CVE-2023-43806.3A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in pla CVE-2023-438007.8Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A u CVE-2023-438017.1Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and CVE-2023-438027.8Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles reques CVE-2023-438037.1Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and CVE-2023-438048.1urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for CVE-2023-438057.5Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can a CVE-2023-438097.5Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an CVE-2023-43814.3Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-438107.5OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecti CVE-2023-438138.8GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature c