CVE-2024-39302

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.6.18 BigBlueButton versions prior to 2.7.8 BigBlueButton versions prior to 3.0.0-alpha.7

Description An attacker may exploit overly elevated file permissions in the /usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0 directory for privilege escalation, potentially exposing sensitive server information.

Recommendations For versions prior to 2.6.18, update to version 2.6.18 or later. For versions prior to 2.7.8, update to version 2.7.8 or later. For versions prior to 3.0.0-alpha.7, update to version 3.0.0-alpha.7 or later.