Vulnerability · Published Jun 1, 2022 · Assigned by GitHub_M

CVE-2022-29236Improper access control for pencil annotations in BigBlueButton

Medium 4.3

In plain English

A medium-severity security flaw in bigbluebutton from bigbluebutton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.9%top 40.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced grace period. The attacker must be a meeting participant. The problem has been patched in versions 2.3.18 and 2.4-rc-6. There are currently no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
bigbluebutton	bigbluebutton	>= 2.2, < 2.3.18>= 2.4-alpha-1, < 2.4-rc-6

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-p93g-r9gm-9v6r x_refsource_CONFIRM
https://github.com/bigbluebutton/bigbluebutton/pull/13803 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/pull/14265 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 x_refsource_MISC