CVE-2022-41962

Katalog CVE

CVSS 2.7 · Low EPSS 0,69%

Kerentanan Incorrect Authorization pada bigbluebutton. Skor CVSS 3.1 2.7 (Low) menurut NVD.

Deskripsi (NVD)

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. Moderators should only be able to set none as the status of other users. This issue is patched in 2.4-rc-6 and 2.5-alpha-1There are no workarounds.

Rincian

Terbit di NVD

16 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

2.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-88qf-33qm-9mm7 patch · release notes · advisory pihak ketiga
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 release notes · advisory pihak ketiga
• https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1 release notes · advisory pihak ketiga