What’s Vulnerable › Vulnerabilities

CVE-2023-43798: BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-30 · updated 2026-06-17
• Weakness: CWE-918

Description

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at `httpclient.execute` since the software no longer has to follow it when using `finalUrl`. There are no known workarounds. We recommend upgrading to a patched version of BigBlueButton.

Affected products

• bigbluebutton: before 2.6.12; 2.7.0-alpha1, 2.7.0-alpha2, 2.7.0-alpha3, 2.7.0-beta1, 2.7.0-beta2, 2.7.0-beta3 — fixed in 2.6.12

How to fix

Upgrade to a fixed version: bigbluebutton 2.6.12. Check the vendor advisory for mitigations.

References

• https://github.com/bigbluebutton/bigbluebutton/pull/18494
• https://github.com/bigbluebutton/bigbluebutton/pull/18580
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4
• https://github.com/bigbluebutton/bigbluebutton/pull/18494
• https://github.com/bigbluebutton/bigbluebutton/pull/18580
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4

Get alerted when CVE-2023-43798 or the next vulnerability affects your stack