2.7

CVE-2022-41962

BigBlueButton contains Incorrect Authorization for setting emoji status

Improper access control for setting emoji status

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. Moderators should only be able to set none as the status of other users. This issue is patched in 2.4-rc-6 and 2.5-alpha-1There are no workarounds.
Mögliche Gegenmaßnahme
Server: No workaround.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
BigBlueButton ≫ BigBlueButton Version < 2.4
BigBlueButton ≫ BigBlueButton Version 2.4 Update alpha1
BigBlueButton ≫ BigBlueButton Version 2.4 Update alpha2
BigBlueButton ≫ BigBlueButton Version 2.4 Update beta1
BigBlueButton ≫ BigBlueButton Version 2.4 Update beta2
BigBlueButton ≫ BigBlueButton Version 2.4 Update beta3
BigBlueButton ≫ BigBlueButton Version 2.4 Update beta4
BigBlueButton ≫ BigBlueButton Version 2.4 Update rc1
BigBlueButton ≫ BigBlueButton Version 2.4 Update rc3
BigBlueButton ≫ BigBlueButton Version 2.4 Update rc4
BigBlueButton ≫ BigBlueButton Version 2.4 Update rc5
Weitere Schwachstelleninformationen
SystemBigBlueButton
≫
Produkt Server
Version >= 0.0.0, < 2.4-rc-6
Version >= 2.5-alpha-1.0, < 2.5-alpha-1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.66% 0.465
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
security-advisories@github.com 2.7 1.2 1.4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6
Third Party Advisory
Release Notes
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1
Third Party Advisory
Release Notes
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-88qf-33qm-9mm7
Patch
Third Party Advisory
Release Notes
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-88qf-33qm-9mm7
Third Party Advisory