CVE-2022-41962: BigBlueButton contains Incorrect Authorization for setting emoji status
Published Dec 16, 2022
·Updated
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. Moderators should only be able to set none as the status of other users. This issue is patched in 2.4-rc-6 and 2.5-alpha-1There are no workarounds.
Affected Software
11 affected components
BigBlueButton BigBlueButton<2.4
BigBlueButton BigBlueButton=2.4-alpha1
BigBlueButton BigBlueButton=2.4-alpha2
BigBlueButton BigBlueButton=2.4-beta1
BigBlueButton BigBlueButton=2.4-beta2
BigBlueButton BigBlueButton=2.4-beta3
BigBlueButton BigBlueButton=2.4-beta4
BigBlueButton BigBlueButton=2.4-rc1
BigBlueButton BigBlueButton=2.4-rc3
BigBlueButton BigBlueButton=2.4-rc4
BigBlueButton BigBlueButton=2.4-rc5
Remediation
Event History
Dec 16, 2022
CVE Published
via MITRE·12:45 PM
Data Sourced
via MITRE·12:45 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this BigBlueButton vulnerability?
The vulnerability ID for this BigBlueButton vulnerability is CVE-2022-41962.
2
What is the severity level of CVE-2022-41962?
CVE-2022-41962 has a severity level of low.
3
What is the affected version range of BigBlueButton?
Versions prior to 2.4-rc-6 and 2.5-alpha-1 of BigBlueButton are affected.
4
What is the CWE ID for CVE-2022-41962?
The CWE ID for CVE-2022-41962 is 863.
5
How can I fix the BigBlueButton vulnerability CVE-2022-41962?
To fix the CVE-2022-41962 vulnerability in BigBlueButton, upgrade to version 2.4-rc-6 or 2.5-alpha-1.