BigBlueButton Multiple Vulnerabilities Allow Data Manipulation and Redirect Attacks

CERT-Bund issued a security advisory detailing multiple vulnerabilities in BigBlueButton open-source web conferencing software. The vulnerabilities allow remote attackers to manipulate data and conduct redirect attacks to attacker-controlled domains. Affected systems include UNIX operating systems running BigBlueButton versions prior to 3.0.24. The CVSS Base Score is 6.5 (medium) with a Temporal Score of 5.7.

Organizations using BigBlueButton should review the advisory and apply appropriate mitigations to prevent data manipulation and user redirection attacks. Security teams should identify any deployed instances of the affected software and prioritize applying available patches or workarounds.