Vulnerability Bulletins |
MSA-25-0037: Unnecessary CSRF token (sesskey) requirement in some LMS BigBlueButton playback functionality could leak users sesskey to external BBB service |
|
| Affected software | PHP |
|
by Michael Hawkins. Unnecessary sesskey CSRF token requirements were added to some Moodle LMS BigBlueButton functionality which, in addition to causing a non-security regression for the Moodle mobile app, could also result in the users CSRF token being unnecessarily shared with the external BBB service.Severity/Risk:MinorVersions affected:5.0.1, 4.5.5, 4.4.9 and 4.1.19Versions fixed:5.0.2, 4.5.6, 4.4.10 and 4.1.20Reported by:Dani PalouCVE identifier:Pending (will be added once available)Changes More info: https://moodle.org/mod/forum/discuss.php?d=469490&parent=1884759 |
|