Description
BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll. The attacker had to be a meeting presenter. This issue is patched in version 2.4.0. There are no workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| bigbluebutton | bigbluebutton | >= 2.4-alpha-1, < 2.4.0 | — |
Advisories 1
- WID-SEC-2022-2350 BigBlueButton: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 5, 2025