CVE-2022-41962: BigBlueButton contains Incorrect Authorization for setting emoji status
First published: Fri Dec 16 2022(Updated: )
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. Moderators should only be able to set none as the status of other users. This issue is patched in 2.4-rc-6 and 2.5-alpha-1There are no workarounds.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bigbluebutton Bigbluebutton | <2.4 | |
| Bigbluebutton Bigbluebutton | =2.4-alpha1 | |
| Bigbluebutton Bigbluebutton | =2.4-alpha2 | |
| Bigbluebutton Bigbluebutton | =2.4-beta1 | |
| Bigbluebutton Bigbluebutton | =2.4-beta2 | |
| Bigbluebutton Bigbluebutton | =2.4-beta3 | |
| Bigbluebutton Bigbluebutton | =2.4-beta4 | |
| Bigbluebutton Bigbluebutton | =2.4-rc1 | |
| Bigbluebutton Bigbluebutton | =2.4-rc3 | |
| Bigbluebutton Bigbluebutton | =2.4-rc4 | |
| Bigbluebutton Bigbluebutton | =2.4-rc5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this BigBlueButton vulnerability?
The vulnerability ID for this BigBlueButton vulnerability is CVE-2022-41962.
What is the severity level of CVE-2022-41962?
CVE-2022-41962 has a severity level of low.
What is the affected version range of BigBlueButton?
Versions prior to 2.4-rc-6 and 2.5-alpha-1 of BigBlueButton are affected.
What is the CWE ID for CVE-2022-41962?
The CWE ID for CVE-2022-41962 is 863.
How can I fix the BigBlueButton vulnerability CVE-2022-41962?
To fix the CVE-2022-41962 vulnerability in BigBlueButton, upgrade to version 2.4-rc-6 or 2.5-alpha-1.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/severity
- agent/weakness
- agent/title
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/bigbluebutton
- canonical/bigbluebutton bigbluebutton
- version/bigbluebutton bigbluebutton/2.4-alpha1
- version/bigbluebutton bigbluebutton/2.4-alpha2
- version/bigbluebutton bigbluebutton/2.4-beta1
- version/bigbluebutton bigbluebutton/2.4-beta2
- version/bigbluebutton bigbluebutton/2.4-beta3
- version/bigbluebutton bigbluebutton/2.4-beta4
- version/bigbluebutton bigbluebutton/2.4-rc1
- version/bigbluebutton bigbluebutton/2.4-rc3
- version/bigbluebutton bigbluebutton/2.4-rc4
- version/bigbluebutton bigbluebutton/2.4-rc5