CVE-2022-23488: BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied. (The required streamId was being sent to all users even with lock setting applied). This issue is fixed in version 2.4-rc-6. There are no workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-23488?
CVE-2022-23488 is a vulnerability in the BigBlueButton web conferencing system that allows attackers to subscribe to viewers' webcams.
What version of BigBlueButton is affected by CVE-2022-23488?
Versions prior to 2.4-rc-6 of BigBlueButton are affected by CVE-2022-23488.
How severe is CVE-2022-23488?
CVE-2022-23488 has a severity rating of 7.5 (high).
How can I fix CVE-2022-23488?
To fix CVE-2022-23488, you should update your BigBlueButton installation to version 2.4-rc-6 or later.
Where can I find more information about CVE-2022-23488?
You can find more information about CVE-2022-23488 on the BigBlueButton GitHub page and the BigBlueButton security advisories page.