Bug 2243442 (CVE-2023-5543, MSA-23-0035)

Summary: CVE-2023-5543 moodle: Duplicating a BigBlueButton activity assigns the same meeting ID
Product: [Other] Security Response Reporter: Robb Gatica <rgatica>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: ntait, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: moodle 4.2.3, moodle 4.1.6, moodle 4.0.11 Doc Type: If docs needed, set a value
Doc Text:
When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2244904, 2244905    
Bug Blocks: 2243346    

Description Robb Gatica 2023-10-12 00:09:32 UTC 
When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting. This flaw affects versions 4.2 to 4.2.2, 4.1 to 4.1.5 and 4.0 to 4.0.10.
Comment 1 Nick Tait 2023-10-18 18:47:21 UTC 
https://moodle.org/mod/forum/discuss.php?d=451584
Comment 2 Nick Tait 2023-10-18 20:45:31 UTC 
Created moodle tracking bugs for this issue:

Affects: epel-7 [bug 2244904]
Affects: fedora-all [bug 2244905]