Description (CNA)
BigBlueButton is an open-source virtual classroom. In versions on the 3.x branch prior to 3.0.20, the string received with errorRedirectUrl lacks validation, using it directly in the respondWithRedirect function leads to an Open Redirect vulnerability. BigBlueButton 3.0.20 patches the issue. No known workarounds are available.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| bigbluebutton / bigbluebutton | affected >= 3.0.0, < 3.0.20 |
CWE
CWE-601
References
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-65cv-rg9f-qqrx
- https://github.com/bigbluebutton/bigbluebutton/commit/691f92f3af0d6b796b91cb968977068663119812
ADP enrichment
No English description supplied.
No references supplied.