CVE-2022-29235: Limited data exposure for shared external videos in BigBlueButton
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds.
Other sources
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and up to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-29235?
CVE-2022-29235 is a vulnerability in the BigBlueButton web conferencing system that allows an attacker with the meeting identifier to obtain information about an external video being shared.
What is the severity of CVE-2022-29235?
The severity of CVE-2022-29235 is medium with a score of 5.3.
Which versions of BigBlueButton are affected by CVE-2022-29235?
BigBlueButton versions 2.2 up to versions 2.3.18 and 2.4-rc-6 are affected by CVE-2022-29235.
How can an attacker exploit CVE-2022-29235?
An attacker can exploit CVE-2022-29235 by obtaining the meeting identifier for a meeting on a server and using it to find information about an external video being shared.
Is there a fix for CVE-2022-29235?
Yes, a fix for CVE-2022-29235 is available in BigBlueButton version 2.3.18 and can be downloaded from the official BigBlueButton website.