Vulnerability record · CVE-2023-43798 · published 30 October 2023

CVE-2023-43798: Bigbluebutton server-side request forgery (ssrf) vulnerability

Bigbluebutton · Bigbluebutton

BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). This issue is a bypass of CVE-2023-33176. A patch in versions 2.6.12 and 2.7.0-rc.1 disabled follow redirect at `httpclient.execute` since the software no longer has to follow it when using `finalUrl`. There are no known workarounds. We recommend upgrading to a patched version of BigBlueButton.

5.4 CVSS 3.1 Medium EPSS 0.42% · top 66.4% CWE-918 · Server-side request forgery (SSRF)

5.4CVSS 3.1 base score

0.42%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Bigbluebutton Bigbluebutton

References

Link	Tags
https://github.com/bigbluebutton/bigbluebutton/pull/18494	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/18580	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/18494	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/18580	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3q22-hph2-cff7	Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-h98v-2h8w-99c4	Third Party Advisory

Track CVE-2023-43798 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-27602Bigbluebutton injection vulnerabilityBigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.EPSS 1.4%29 Sep 2022 9.8CVE-2020-27605Bigbluebutton vulnerabilityBigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schw…EPSS 1.2%21 Oct 2020 9.8CVE-2020-12443Bigbluebutton path traversal vulnerabilityBigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while th…EPSS 3.7%29 Apr 2020 8.8CVE-2023-42803Bigbluebutton unrestricted file upload vulnerabilityBigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the i…EPSS 0.54%30 Oct 2023 8.4CVE-2020-27613Bigbluebutton cleartext storage of sensitive data vulnerabilityThe installation procedure in BigBlueButton before 2.2.28 (or earlier) uses ClueCon as the FreeSWITCH password, which allows local users to achieve u…EPSS 0.27%21 Oct 2020 8.2CVE-2026-27466Bigbluebutton exposure of resource to wrong sphere vulnerabilityBigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for "Server Customization" on Support for…EPSS 0.58%21 Feb 2026 7.5CVE-2025-61601Bigbluebutton vulnerabilityBigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user …EPSS 0.47%9 Oct 2025 7.5CVE-2025-61602Bigbluebutton vulnerabilityBigBlueButton is an open-source virtual classroom. A denial-of-service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user …EPSS 0.39%9 Oct 2025

Source: NIST National Vulnerability Database (record CVE-2023-43798), CISA KEV, FIRST EPSS (scores of 2026-09-30). This page is refreshed as NVD updates the record.