CVE-2022-29233
In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in.
Does this matter?
Lower severity and a low EPSS score (1.01%). Track it; it rarely justifies an emergency change on its own.
Description
BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.01% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-285
- Affected
- bigbluebutton/bigbluebutton
- Source
- security-advisories@github.com
References
- https://github.com/bigbluebutton/bigbluebutton/pull/13117Patch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/pull/14265Patch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18Release Notes, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1Release Notes, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33Patch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/pull/13117Patch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/pull/14265Patch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18Release Notes, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1Release Notes, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.