7.5
CVE-2025-61601
- EPSS 0.43%
- Veröffentlicht 09.10.2025 20:29:25
- Zuletzt bearbeitet 20.10.2025 15:33:21
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation
DoS via PollSubmitVote GraphQL mutation leads to BigBlueButton server crash
BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array in the `answerIds` field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available.
Mögliche Gegenmaßnahme
Server: There are no workarounds. We recommend upgrading to a patched version of BigBlueButton.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
BigBlueButton ≫ BigBlueButton Version < 3.0.13
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
LoginWeitere Schwachstelleninformationen
SystemBigBlueButton
≫
Produkt
Server
Version
< 3.0.13
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.43% | 0.342 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-703 Improper Check or Handling of Exceptional Conditions
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5
https://github.com/bigbluebutton/bigbluebutton/pull/23662
https://www.youtube.com/watch?v=BwROSVIYjOY
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5