CVE-2022-29236: Improper access control for pencil annotations in BigBlueButton
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced grace period. The attacker must be a meeting participant. The problem has been patched in versions 2.3.18 and 2.4-rc-6. There are currently no known workarounds.
Other sources
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and up to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced grace period. The attacker must be a meeting participant. The problem has been patched in versions 2.3.18 and 2.4-rc-6. There are currently no known workarounds.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-29236?
CVE-2022-29236 is a vulnerability in BigBlueButton, an open source web conferencing system, that allows an attacker to bypass access restrictions for drawing on the whiteboard.
Which versions of BigBlueButton are affected by CVE-2022-29236?
BigBlueButton versions 2.2 up to 2.3.18 and 2.4-rc-6 are affected by CVE-2022-29236.
What is the severity of CVE-2022-29236?
The severity of CVE-2022-29236 is medium with a CVSS score of 4.3.
How can an attacker exploit CVE-2022-29236?
An attacker can exploit CVE-2022-29236 by circumventing access restrictions for drawing on the whiteboard in affected versions of BigBlueButton.
Has a fix been released for CVE-2022-29236?
Yes, a fix has been released for CVE-2022-29236. It is recommended to update to BigBlueButton version 2.3.18 or follow the provided patches in the GitHub references.