5
CVE-2022-29233
- EPSS 0.96%
- Veröffentlicht 02.06.2022 00:15:08
- Zuletzt bearbeitet 21.11.2024 06:58:46
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginImproper access control for breakout rooms in BigBlue Button
Improper access control for breakout rooms
BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.
Mögliche Gegenmaßnahme
Server: No workaround.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
BigBlueButton ≫ BigBlueButton Version >= 2.2.0 < 2.3.18
BigBlueButton ≫ BigBlueButton Version2.4 Updatealpha1
BigBlueButton ≫ BigBlueButton Version2.4 Updatealpha2
BigBlueButton ≫ BigBlueButton Version2.4 Updatebeta1
BigBlueButton ≫ BigBlueButton Version2.4 Updatebeta2
BigBlueButton ≫ BigBlueButton Version2.4 Updatebeta3
BigBlueButton ≫ BigBlueButton Version2.4 Updatebeta4
Weitere Schwachstelleninformationen
SystemBigBlueButton
≫
Produkt
Server
Version
>= 0.0.0, < 2.3.18
Version
>= 2.4-rc-1.0, < 2.4-rc-1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.96% | 0.569 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
| security-advisories@github.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
CWE-285 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
https://github.com/bigbluebutton/bigbluebutton/pull/13117
https://github.com/bigbluebutton/bigbluebutton/pull/14265
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33