CVE-2023-43798

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at `httpclient.execute` since the software no longer has to follow it when using `finalUrl`. There are no known workarounds. We recommend upgrading to a patched version of BigBlueButton.

• CWE-918

• https://github.com/bigbluebutton/bigbluebutton/pull/18494Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/pull/18580Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/pull/18494Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/pull/18580Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4Third Party Advisory

Published

Oct 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43792baserCMS is a website development framework. In versions 4.6…9.8
• CVE-2023-43793Misskey is an open source, decentralized social media platfo…7.5
• CVE-2023-43794Nocodb is an open source Airtable alternative. Affected vers…4.9
• CVE-2023-43795GeoServer is an open source software server written in Java …9.8
• CVE-2023-43796Synapse is an open-source Matrix homeserver Prior to version…5.3
• CVE-2023-43797BigBlueButton is an open-source virtual classroom. Prior to …5.4
• CVE-2023-43799Altair is a GraphQL Client. Prior to version 5.2.5, the Alta…7.8
• CVE-2023-4380A logic flaw exists in Ansible Automation platform. Whenever…6.3
• CVE-2023-43800Arduino Create Agent is a package to help manage Arduino dev…7.8
• CVE-2023-43801Arduino Create Agent is a package to help manage Arduino dev…7.1
• CVE-2023-43802Arduino Create Agent is a package to help manage Arduino dev…7.8
• CVE-2023-43803Arduino Create Agent is a package to help manage Arduino dev…7.1