Skip to content
OpenAdvisories
Medium WID-SEC-2022-2350 7 CVEs

BigBlueButton: Mehrere Schwachstellen

Published Dec 15, 2022 · Updated Oct 5, 2025 · Revision 3 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in BigBlueButton ausnutzen, um Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren und Sicherheitsmaßnahmen zu umgehen.

Product

BigBlueButton ist ein Open-Source-Web-Konferenzsystem.

Vulnerabilities 7

  • Medium 6.5
    CVE-2022-23488

    BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data

    BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subsc…

    bigbluebutton bigbluebutton
  • Medium 5.7
    CVE-2022-41964

    BigBlueButton contains Response leaks in anonymous polls

    BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see indivi…

    bigbluebutton bigbluebutton
  • Medium 4.3
    CVE-2022-23490

    Improper access control to polling votes

    BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collecti…

    bigbluebutton bigbluebutton
  • Medium 4.3
    CVE-2022-41960

    BigBlueButton contains DoS via failed authToken validation

    BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to `validateAuthToken` using a victim's userId,…

    bigbluebutton bigbluebutton
  • Medium 4.3
    CVE-2022-41961

    BigBlueButton subject to Ineffective user bans

    BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the me…

    bigbluebutton bigbluebutton
  • Low 2.7
    CVE-2022-41962

    BigBlueButton contains Incorrect Authorization for setting emoji status

    BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other user…

    bigbluebutton bigbluebutton
  • Low 2.7
    CVE-2022-41963

    BigBlueButton contains Improper Preservation of Permissions for whiteboard

    BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access i…

    bigbluebutton bigbluebutton

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2022-28546

  2. #2

    CVE ergänzt

  3. #1

    Initiale Fassung

References