CVE-2022-29233

BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.

Link	Resource
https://github.com/bigbluebutton/bigbluebutton/pull/14265	Patch Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18	Release Notes Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33	Patch Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/13117	Patch Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1	Release Notes Third Party Advisory

Configuration 1

cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha1:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha2:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta2:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta1:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta3:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta4:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*

---

Published : 2022-06-02 12:15

Updated : 2022-06-09 02:56

---

NVD link : CVE-2022-29233

Mitre link : CVE-2022-29233

No products.

CWE-285