VULNERABILITY INTELLIGENCE

CVE-2023-42803

CVSS score5.3 MEDIUM
EPSS probability0.66%
CISA KEVNot currently listed
Published2023-10-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Description

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocument API call does not validate the given file extension before saving the file, and does not remove it in case of validation failures. BigBlueButton 2.6.0-beta.2 contains a patch. There are no known workarounds.

Weakness classification

  • security-advisories@github.com: CWE-434

Primary references