CVE-2022-23490

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collection does not update the client UI, but does give the attacker access to the contents of the collection, which include the individual poll responses. This issue is patched in version 2.4.0. There are no workarounds.
Configurations

Configuration 1 (hide)

cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*

History

21 Nov 2024, 06:48

Type Values Removed Values Added
References () https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0 - Release Notes, Third Party Advisory () https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0 - Release Notes, Third Party Advisory
References () https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4qgc-xhw5-6qfg - Patch, Third Party Advisory () https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4qgc-xhw5-6qfg - Patch, Third Party Advisory

07 Nov 2023, 03:44

Type Values Removed Values Added
Summary BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collection does not update the client UI, but does give the attacker access to the contents of the collection, which include the individual poll responses. This issue is patched in version 2.4.0. There are no workarounds. BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collection does not update the client UI, but does give the attacker access to the contents of the collection, which include the individual poll responses. This issue is patched in version 2.4.0. There are no workarounds.

Information

Published : 2022-12-16 22:15

Updated : 2024-11-21 06:48


NVD link : CVE-2022-23490

Mitre link : CVE-2022-23490

CVE.ORG link : CVE-2022-23490


JSON object : View

Products Affected

bigbluebutton

  • bigbluebutton
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-863

Incorrect Authorization