CVE-2025-61601

{
  "id": "CVE-2025-61601",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-09T21:15:39.477",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "BigBlueButton is an open-source virtual classroom. A Denial of Service (DoS) vulnerability in versions prior to 3.0.13 allows any authenticated user to freeze or crash the entire server by abusing the polling feature's `Choices` response type. By submitting a malicious payload with a massive array in the `answerIds` field, the attacker can cause the current meeting — and potentially all meetings on the server — to become unresponsive. Version 3.0.13 contains a patch. No known workarounds are available."
    },
    {
      "lang": "es",
      "value": "BigBlueButton es un aula virtual de código abierto. Una vulnerabilidad de denegación de servicio (DoS) en versiones anteriores a la 3.0.13 permite a cualquier usuario autenticado congelar o colapsar todo el servidor abusando del tipo de respuesta 'Choices' de la función de encuestas. Al enviar una carga útil maliciosa con un array masivo en el campo 'answerIds', el atacante puede causar que la reunión actual - y potencialmente todas las reuniones en el servidor - dejen de responder. La versión 3.0.13 contiene un parche. No hay soluciones alternativas conocidas disponibles."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "bigbluebutton",
          "product": "bigbluebutton",
          "versions": [
            {
              "version": "< 3.0.13",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-15T19:47:11.105155Z",
          "id": "CVE-2025-61601",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-703"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.0.13",
              "matchCriteriaId": "0AF3725E-941E-4C75-AA27-20DC97552948"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/pull/23662",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.youtube.com/watch?v=BwROSVIYjOY",
      "source": "[email protected]",
      "tags": [
        "Exploit"
      ]
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-73j3-v3fq-fqx5",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://www.youtube.com/watch?v=BwROSVIYjOY",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit"
      ]
    }
  ]
}