CVE-2024-38518

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an attacker to join a meeting as moderator using a join link that was originally created for viewer access. This vulnerability has been patched in version(s) 2.6.18, 2.7.8 and 3.0.0-alpha.7.

• CWE-284

• https://github.com/bigbluebutton/bigbluebutton/commit/a9d436accdcd26ea66bed9f391488ac128cd62d1
• https://github.com/bigbluebutton/bigbluebutton/commit/ea6e9461dceae8fa593543d8c686f77bb8677e72
• https://github.com/bigbluebutton/bigbluebutton/pull/20279
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4
• https://github.com/bigbluebutton/bigbluebutton/commit/a9d436accdcd26ea66bed9f391488ac128cd62d1
• https://github.com/bigbluebutton/bigbluebutton/commit/ea6e9461dceae8fa593543d8c686f77bb8677e72
• https://github.com/bigbluebutton/bigbluebutton/pull/20279
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4m48-49h7-f3c4

Published

Jun 28, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-38512A privilege escalation vulnerability was discovered in XCC t…7.2
• CVE-2024-38513Fiber is an Express-inspired web framework written in Go A v…9.8
• CVE-2024-38514NextChat is a cross-platform ChatGPT/Gemini UI. There is a S…7.4
• CVE-2024-38515Rejected reason: This CVE is a duplicate of CVE-2024-38374.
• CVE-2024-38516ai-client-html is an Aimeos e-commerce HTML client component…8.8
• CVE-2024-38517Tencent RapidJSON is vulnerable to privilege escalation due …7.8
• CVE-2024-38519`yt-dlp` and `youtube-dl` are command-line audio/video downl…7.8
• CVE-2024-3852GetBoundName could return the wrong version of an object whe…7.5
• CVE-2024-38520SoftEtherVPN is a an open-source cross-platform multi-protoc…5.3
• CVE-2024-38521Hush Line is a free and open-source, anonymous-tip-line-as-a…6.1
• CVE-2024-38522Hush Line is a free and open-source, anonymous-tip-line-as-a…6.3
• CVE-2024-38523Hush Line is a free and open-source, anonymous-tip-line-as-a…7.5