BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied. (The required streamId was being sent to all users even with lock setting applied). This issue is fixed in version 2.4-rc-6. There are no workarounds.
References
| Link | Resource |
|---|---|
| https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 | Release Notes Third Party Advisory |
| https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5g3-f74q-rvfq | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:44
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied. (The required streamId was being sent to all users even with lock setting applied). This issue is fixed in version 2.4-rc-6. There are no workarounds. |
27 Jun 2023, 15:11
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-863 |
22 Dec 2022, 13:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Bigbluebutton bigbluebutton
Bigbluebutton |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CWE | CWE-201 |
CWE-668 |
| References | (MISC) https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 - Release Notes, Third Party Advisory | |
| References | (MISC) https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5g3-f74q-rvfq - Patch, Third Party Advisory | |
| CPE | cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta4:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta2:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc5:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc4:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta3:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc1:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta1:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha1:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc3:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc2:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha2:*:*:*:*:*:* |
17 Dec 2022, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-17 01:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-23488
Mitre link : CVE-2022-23488
CVE.ORG link : CVE-2022-23488
JSON object : View
Products Affected
bigbluebutton
- bigbluebutton