Log in Start free

Vulnerability · Published Jun 1, 2022 · Assigned by GitHub_M

CVE-2022-29233Improper access control for breakout rooms in BigBlue Button

Medium 4.3

In plain English

A medium-severity security flaw in bigbluebutton from bigbluebutton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)1.1%top 35.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.

Affected products (as reported)

VendorProductVersions
bigbluebutton bigbluebutton >= 2.2, < 2.3.18>= 2.4-alpha-1, < 2.4-rc-1

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References