PT-2022-26184 · Unknown · Bigbluebutton

Juraj Somorovsky + 2 · Published 2022-12-15 · Updated 2022-12-20 · CVE-2022-41960

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.4.3

Description The issue is related to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to validateAuthToken using a victim's userId, meetingId, and an invalid authToken. This forces the victim to leave the conference because the resulting verification failure is also observed and handled by the victim's client. The attacker must be a participant in any meeting on the server.

Recommendations For versions prior to 2.4.3, update to version 2.4.3 to resolve the issue. As a temporary workaround, consider restricting access to the validateAuthToken function until the update is applied. Additionally, restrict the ability for participants to make Meteor calls with invalid authToken to minimize the risk of exploitation.

Exploit

Fix

DoS

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2022-41960

GHSA-RGJP-3R74-G4CM

Affected Products

Bigbluebutton

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41960.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-41960 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41960 · Vendor Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rgjp-3r74-g4cm · Note
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1 · Note
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3 · Note
• https://t.me/cvenotify/40030 · Telegram Post
• https://t.me/cvenotify/40007 · Telegram Post