CVE-2022-41964

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-41964
BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll. The attacker had to be a meeting presenter. This issue is patched in version 2.4.0. There are no workarounds.

5.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0 Release Notes Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4 Patch Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0 Release Notes Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha1:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha2:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta1:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta2:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta3:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta4:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc1:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc2:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc3:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc4:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc5:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc6:*:*:*:*:*:*
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc7:*:*:*:*:*:*
History

21 Nov 2024, 07:24

Type Values Removed Values Added
References () https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0 - Release Notes, Third Party Advisory () https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0 - Release Notes, Third Party Advisory
References () https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4 - Patch, Third Party Advisory () https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4 - Patch, Third Party Advisory
Summary
  • (es) BigBlueButton es un sistema de conferencias web de código abierto. Esta vulnerabilidad solo afecta a las versiones candidatas de BigBlueButton 2.4. El atacante puede iniciar una suscripción para obtener los resultados de la encuesta antes de iniciar una encuesta anónima y utilizar esta suscripción para ver las respuestas individuales en la encuesta anónima. El atacante debía ser presentador de una reunión. Este problema se solucionó en la versión 2.4.0. No hay workarounds.
Information

Published : 2022-12-16 18:15

Updated : 2024-11-21 07:24

NVD link : CVE-2022-41964

Mitre link : CVE-2022-41964

CVE.ORG link : CVE-2022-41964

JSON object : View

Products Affected

bigbluebutton

  • bigbluebutton
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor