PT-2022-19482 · Unknown · Bigbluebutton

Juraj Somorovsky + 2 · Published 2022-06-01 · Updated 2022-06-09 · CVE-2022-29232

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions 2.2 through 2.3.8 BigBlueButton versions 2.4-beta before 2.4-beta-1

Description BigBlueButton is an open source web conferencing system. An attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server, provided they are a participant in a meeting on the server.

Recommendations For BigBlueButton versions 2.2 through 2.3.8, update to version 2.3.9 to resolve the issue. For BigBlueButton versions 2.4-beta before 2.4-beta-1, update to version 2.4-beta-1 to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-29232

GHSA-3FQH-P4QR-VFM9

Affected Products

Bigbluebutton

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29232.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/pull/12861 · Patch
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3fqh-p4qr-vfm9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29232 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29232 · Vendor Advisory
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-beta-1 · Note
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.9 · Note
• https://t.me/cvenotify/30993 · Telegram Post