Vulnerability · Published Jun 1, 2022 · Assigned by GitHub_M

CVE-2022-29232Exposure of messages in BigBlueButton public chats

Medium 6.5

In plain English

A medium-severity information exposure in bigbluebutton from bigbluebutton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.1%top 34.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a meeting on the server. BigBlueButton versions 2.3.9 and 2.4-beta-1 contain a patch for this issue. There are currently no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
bigbluebutton	bigbluebutton	>= 2.2, < 2.3.9>= 2.4-alpha-1, < 2.4-beta-1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3fqh-p4qr-vfm9 x_refsource_CONFIRM
https://github.com/bigbluebutton/bigbluebutton/pull/12861 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.9 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-beta-1 x_refsource_MISC