A critical Denial of Service vulnerability in BigBlueButton allows authenticated users to crash the entire server via the polling feature, necessitating an immediate update to version 3.0.13.

This vulnerability involves an improper check of exceptional conditions (CWE-703) within the polling feature. An authenticated user can submit a malicious payload containing a massive array in the answerIds field, causing the application to become unresponsive.

The ability for an authenticated user to induce a server-wide Denial of Service poses a significant risk to organizational continuity. Successful exploitation results in the total unavailability of virtual classroom services, leading to immediate disruption of meetings and potential reputational damage. While the CVSS score of 7.5 reflects a High severity impact to availability, the operational disruption to collaborative environments makes this a priority for any institution relying on BigBlueButton.

Immediate Action: Update the BigBlueButton server software to version 3.0.13 or later to apply the necessary input validation fixes.

Proactive Monitoring: Monitor server CPU and memory utilization patterns, specifically looking for spikes associated with polling requests or anomalous activity in meeting logs.

Compensating Controls: Implement rate limiting on meeting-related API endpoints to restrict the frequency of polling actions, which may limit the impact of exploitation attempts until patching is complete.

Public Exploit Available: No (exploit_available: unknown)

Given the potential for complete service disruption, administrators should prioritize the deployment of version 3.0.13. Organizations that cannot immediately patch should restrict polling permissions or implement strict monitoring of meeting traffic to detect and mitigate potential abuse by authenticated users.