CVE-2022-29234: Grace period for lock settings in public/private chats in BigBlueButton
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds.
Other sources
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and up to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s after the lock setting was enacted. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-29234?
CVE-2022-29234 is a vulnerability in BigBlueButton, an open source web conferencing system, where an attacker could send messages to a locked chat within a grace period of 5s after the lock setting was enacted.
How does CVE-2022-29234 affect BigBlueButton?
CVE-2022-29234 affects BigBlueButton versions 2.2 to 2.3.18 and versions 2.4 to 2.4.1.
What is the severity of CVE-2022-29234?
CVE-2022-29234 has a severity rating of 4.3, which is considered medium.
How can an attacker exploit CVE-2022-29234?
An attacker needs to be a participant in the meeting and can send messages to a locked chat within 5 seconds after the lock setting was enacted.
How can I fix CVE-2022-29234 in BigBlueButton?
To fix CVE-2022-29234, you should update your BigBlueButton installation to version 2.3.18 or 2.4.1, which contain the necessary security patches.