CVE-2022-29236

Katalog CVE

CVSS 4.3 · Medium EPSS 0,87%

Kerentanan Improper Authorization pada bigbluebutton. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced grace period. The attacker must be a meeting participant. The problem has been patched in versions 2.3.18 and 2.4-rc-6. There are currently no known workarounds.

Rincian

Terbit di NVD

2 Juni 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,87% peluang dieksploitasi; lebih tinggi dari 57,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bigbluebutton/bigbluebutton/pull/13803 patch · advisory pihak ketiga
• https://github.com/bigbluebutton/bigbluebutton/pull/14265 patch · advisory pihak ketiga
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-p93g-r9gm-9v6r patch · advisory pihak ketiga
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18 release notes · advisory pihak ketiga
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 release notes · advisory pihak ketiga