CVE-2022-29234
Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed.
Does this matter?
Lower severity and a low EPSS score (0.82%). Track it; it rarely justifies an emergency change on its own.
Description
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds.
- CVSS 3.1
- 4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.82% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-285
- Affected
- bigbluebutton/bigbluebutton
- Source
- security-advisories@github.com
References
- https://github.com/bigbluebutton/bigbluebutton/pull/13850Patch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/pull/14265Patch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18Release Notes, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.1Release Notes, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-36vc-c338-6xjvPatch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/pull/13850Patch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/pull/14265Patch, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18Release Notes, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.1Release Notes, Third Party Advisory
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-36vc-c338-6xjvPatch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.