PT-2022-26187 · Unknown · Bigbluebutton

Juraj Somorovsky + 2 · Published 2022-12-16 · Updated 2022-12-20 · CVE-2022-41963

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.4.3

Description BigBlueButton is an open source web conferencing system. The system contains a whiteboard grace period to handle delayed messages, but this period can be exploited by attackers to perform actions in the few seconds after their access is revoked. The attacker must be a meeting participant.

Recommendations For versions prior to 2.4.3, update to version 2.4.3 or 2.5-alpha-1 to resolve the issue. As a temporary workaround, consider restricting access to the whiteboard feature for meeting participants until the update is applied.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2022-41963

GHSA-V6P9-926C-6QFP

Affected Products

Bigbluebutton

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41963.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6p9-926c-6qfp · Patch
• https://osv.dev/vulnerability/CVE-2022-41963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41963 · Security Note
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3 · Note
• https://t.me/cvenotify/40246 · Telegram Post
• https://t.me/cibsecurity/54661 · Telegram Post
• https://t.me/cvenotify/40054 · Telegram Post