moodle: BigBlueButton web service leaks meeting joining information to users who should not have access (CVE-2024-38273)
A vulnerability in Moodle's BigBlueButton web service allows unauthorized users to access meeting join URLs due to insufficient capability checks. This flaw affects multiple Moodle versions prior to their respective patches. The issue could lead to unauthorized disclosure of meeting joining information. A patch is available to address this vulnerability.
AI Analysis
Technical Summary
CVE-2024-38273 is a vulnerability in Moodle where insufficient capability checks in the BigBlueButton integration permit users to obtain join URLs for meetings they are not authorized to access. This results in unauthorized exposure of meeting joining information. The vulnerability affects Moodle versions 4.1.0 up to but not including 4.1.11, 4.2.0 up to but not including 4.2.8, 4.3.0 up to but not including 4.3.5, and 4.4.0 up to but not including 4.4.1. A patch is available for these versions.
Potential Impact
Users without proper permissions can access BigBlueButton meeting join URLs, potentially exposing meeting information to unauthorized individuals. This could lead to privacy breaches or unauthorized meeting participation. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available for the affected Moodle versions. Users should update to versions 4.1.11 or later, 4.2.8 or later, 4.3.5 or later, or 4.4.1 or later to remediate this vulnerability.
moodle: BigBlueButton web service leaks meeting joining information to users who should not have access (CVE-2024-38273)
Description
A vulnerability in Moodle's BigBlueButton web service allows unauthorized users to access meeting join URLs due to insufficient capability checks. This flaw affects multiple Moodle versions prior to their respective patches. The issue could lead to unauthorized disclosure of meeting joining information. A patch is available to address this vulnerability.
Affected software
pkg:bitnami/moodleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-38273 is a vulnerability in Moodle where insufficient capability checks in the BigBlueButton integration permit users to obtain join URLs for meetings they are not authorized to access. This results in unauthorized exposure of meeting joining information. The vulnerability affects Moodle versions 4.1.0 up to but not including 4.1.11, 4.2.0 up to but not including 4.2.8, 4.3.0 up to but not including 4.3.5, and 4.4.0 up to but not including 4.4.1. A patch is available for these versions.
Potential Impact
Users without proper permissions can access BigBlueButton meeting join URLs, potentially exposing meeting information to unauthorized individuals. This could lead to privacy breaches or unauthorized meeting participation. No known exploits in the wild have been reported.
Mitigation Recommendations
A patch is available for the affected Moodle versions. Users should update to versions 4.1.11 or later, 4.2.8 or later, 4.3.5 or later, or 4.4.1 or later to remediate this vulnerability.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-moodle-2024-38273
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2024-38273"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
Threat ID: 6aa00617acd9273b49ab7787
Added to database: 09/08/2026, 12:56:55 UTC
Last enriched: 09/08/2026, 13:43:38 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.