PT-2022-16024 · Unknown · Bigbluebutton

Juraj Somorovsky + 2 · Published 2022-12-16 · Updated 2022-12-22 · CVE-2022-23490

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.4.0

Description The issue affects meetings with polls in BigBlueButton, an open source web conferencing system, where an attacker who is a meeting participant can gain access to sensitive information. Specifically, subscribing to the current-poll collection does not update the client UI but gives the attacker access to the contents of the collection, including individual poll responses.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 to resolve the issue. As a temporary workaround, consider restricting access to meetings with polls until the update is applied.

Exploit

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

CVE-2022-23490

GHSA-4QGC-XHW5-6QFG

Affected Products

Bigbluebutton

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23490.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4qgc-xhw5-6qfg · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23490 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23490 · Vendor Advisory
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0 · Note
• https://t.me/cibsecurity/54792 · Telegram Post