CVE-2022-23490

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.4.0

Description The issue affects meetings with polls in BigBlueButton, an open source web conferencing system, where an attacker who is a meeting participant can gain access to sensitive information. Specifically, subscribing to the current-poll collection does not update the client UI but gives the attacker access to the contents of the collection, including individual poll responses.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 to resolve the issue. As a temporary workaround, consider restricting access to meetings with polls until the update is applied.