PT-2022-26185 · Unknown · Bigbluebutton

Juraj Somorovsky + 2 · Published 2022-12-16 · Updated 2022-12-20 · CVE-2022-41961

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.4-rc-6

Description The issue concerns ineffective user bans in BigBlueButton, an open source web conferencing system. An attacker could register multiple users and join a meeting with one of them. If that user is banned, they could still join the meeting with the remaining registered users from the same extId. This is resolved by improving permissions so that banning a user removes all related users, including those who have not joined the meeting.

Recommendations For versions prior to 2.4-rc-6, update to version 2.4-rc-6 or 2.5-alpha-1 to fix the issue. As a temporary workaround, consider manually removing all users related to the extId of a banned user to prevent them from joining the meeting. Restrict access to the meeting for users with the same extId as a banned user until the update is applied.

Exploit

Fix

Insufficient Verification of Data Authenticity

Origin Validation Error

Weakness Enumeration

CWE-345

CWE-346

Related Identifiers

CVE-2022-41961

GHSA-WXJP-H88G-7FQG

Affected Products

Bigbluebutton

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41961.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wxjp-h88g-7fqg · Patch
• https://osv.dev/vulnerability/CVE-2022-41961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41961 · Security Note
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 · Note
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1 · Note
• https://t.me/cibsecurity/54660 · Telegram Post