BigBlueButton Open Redirect Vulnerability in Versions Prior to 3.0.24

A moderate open redirect vulnerability has been identified in BigBlueButton, an open-source virtual classroom platform. This issue affects versions through 3.0.23 and allows for redirection to a malicious URL via the 'logoutURL' parameter in requests to 'bigbluebutton/api/join'. Version 3.0.24 has addressed this vulnerability by modifying how requests with incorrect checksums are handled, ensuring that the default 'logoutURL' is used instead.

Impact

Exploitation of this vulnerability could lead to an open redirect, where a user is sent to a potentially harmful external URL.

Remediation

Users are advised to update to BigBlueButton version 3.0.24 or later, where this vulnerability has been patched.