PT-2022-26188 · Unknown · Bigbluebutton

Juraj Somorovsky + 2 · Published 2022-12-16 · Updated 2022-12-21 · CVE-2022-41964

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.4.0

Description The issue affects BigBlueButton, an open source web conferencing system, and allows an attacker who is a meeting presenter to start a subscription for poll results before starting an anonymous poll. This subscription can then be used to see individual responses in the anonymous poll.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 to resolve the issue. As a temporary workaround, consider restricting the ability to start subscriptions for poll results before starting an anonymous poll, or limiting the role of meeting presenter to trusted individuals.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-41964

GHSA-FGMJ-RX7J-FQR4

Affected Products

Bigbluebutton

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41964.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41964 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41964 · Vendor Advisory
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0 · Note
• https://t.me/cibsecurity/54769 · Telegram Post