CVE-2022-29233
Assigner: GitHub_M
Published: 2022-06-01T23:15:15
State: PUBLISHED
affected: product: bigbluebutton
vendor: bigbluebutton
versions: status: affected
version: >= 2.2, < 2.3.18
status: affected
version: >= 2.4-alpha-1, < 2.4-rc-1
descriptions: value: BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-285
description: CWE-285: Improper Authorization
type: CWE
source: advisory: GHSA-3mr9-p9gw-cf33
discovery: UNKNOWN
title: Improper access control for breakout rooms in BigBlue Button