CVE-2024-39302

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the `/usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0` directory with the goal of privilege escalation, potentially exposing sensitive information on the server. This issue has been patched in version(s) 2.6.18, 2.7.8 and 3.0.0-alpha.7.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< 2.6.18; >= 2.7.0, < 2.7.8; >= 2.8.0, < 3.0.0-alpha.7

References

Timeline

Published: Jun 28, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-393035.4Weblate is a web based localization tool. Prior to version 5.6.2, Weblate didn't correctly validate filenames when restoring project backup.CVE-2024-393048.8ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL inje CVE-2024-393059.1Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already CVE-2024-393073.5Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside the browsing contex CVE-2024-393085.4RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by imprope CVE-2024-393099.8Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to CVE-2024-39315.4A vulnerability was found in Totara LMS up to 18.7. It has been rated as problematic. Affected by this issue is some unknown functionality o CVE-2024-393105.4The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to CVE-2024-393115.4Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of CVE-2024-393125.3Botan is a C++ cryptography library. X.509 certificates can identify elliptic curves using either an object identifier or using explicit enc CVE-2024-393135.3toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private CVE-2024-393144.7toy-blog is a headless content management system implementation. Starting in version 0.4.3 and prior to version 0.5.0, the administrative pa