CVE-2022-41964

CVSS V2 None CVSS V3 None
Description
BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll. The attacker had to be a meeting presenter. This issue is patched in version 2.4.0. There are no workarounds.
Overview
  • CVE ID
  • CVE-2022-41964
  • Assigner
  • security-advisories@github.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2022-12-16T18:15:08
  • Last Modified Date
  • 2022-12-21T18:51:17
Weakness Enumerations
CWE URL
CWE-200 http://cwe.mitre.org/data/definitions/200.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha1:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha2:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta1:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta2:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta3:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta4:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc3:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc4:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc5:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc6:*:*:*:*:*:* 1 OR
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc7:*:*:*:*:*:* 1 OR
References
Reference URL Reference Tags
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2022-41964
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41964
History
Created Old Value New Value Data Type Notes
2022-12-18 09:31:30 Added to TrackCVE
2022-12-19 19:14:16 2022-12-16T18:15:08.407 2022-12-16T18:15:08 CVE Published Date updated
2022-12-19 19:14:16 2022-12-16T18:29:46 CVE Modified Date updated
2022-12-19 19:14:16 Awaiting Analysis Undergoing Analysis Vulnerability Status updated
2022-12-21 19:14:25 2022-12-21T18:51:17 CVE Modified Date updated
2022-12-21 19:14:25 Undergoing Analysis Analyzed Vulnerability Status updated
2022-12-21 19:14:27 CPE Information updated