CVE-2022-29232

EPSS 0.99%
Veröffentlicht 01.06.2022 23:15:08
Zuletzt bearbeitet 21.11.2024 06:58:46
Quelle security-advisories@github.com
CVE-Watchlists
Login
Unerledigt
Login

Exposure of messages in BigBlueButton public chats

Exposure of messages in public chats

BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a meeting on the server. BigBlueButton versions 2.3.9 and 2.4-beta-1 contain a patch for this issue. There are currently no known workarounds.

Mögliche Gegenmaßnahme

Server: No workarounds.

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 8

NVD 3 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

BigBlueButton ≫ BigBlueButton Version >= 2.2.0 < 2.3.9

BigBlueButton ≫ BigBlueButton Version2.4 Updatealpha1

BigBlueButton ≫ BigBlueButton Version2.4 Updatealpha2

Weitere Schwachstelleninformationen

SystemBigBlueButton

≫

Produkt Server

Version >= 0.0.0, < 2.3.9

Version >= 2.4+.0, < 2.4+

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.99%	0.578

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N
security-advisories@github.com	6.5	2.8	3.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N