Vulnerability · Published Dec 16, 2022 · Assigned by GitHub_M

CVE-2022-41961BigBlueButton subject to Ineffective user bans

Medium 4.3

In plain English

A medium-severity insufficient verification of data authenticity in bigbluebutton from bigbluebutton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 76.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the meeting with the remaining registered users from the same extId. This issue has been fixed by improving permissions such that banning a user removes all users related to their extId, including registered users that have not joined the meeting. This issue is patched in versions 2.4-rc-6 and 2.5-alpha-1. There are no workarounds.

Affected products (as reported)

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< v2.4-rc-6

Weakness: CWE-346, CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wxjp-h88g-7fqg x_refsource_CONFIRM
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1 x_refsource_MISC