PT-2022-19482

CVE-2022-29232

Published

2022-06-01

Updated

2022-06-09

Description by

CVSS 3.1

6.5

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions 2.2 through 2.3.8 BigBlueButton versions 2.4-beta before 2.4-beta-1

Description BigBlueButton is an open source web conferencing system. An attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server, provided they are a participant in a meeting on the server.

Recommendations For BigBlueButton versions 2.2 through 2.3.8, update to version 2.3.9 to resolve the issue. For BigBlueButton versions 2.4-beta before 2.4-beta-1, update to version 2.4-beta-1 to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Juraj Somorovsky

Nico Heitmann

Sven Hebrok

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor