CVE-2022-41963: BigBlueButton contains Improper Preservation of Permissions for whiteboard
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a meeting participant. This issue is patched in version 2.4.3 an version 2.5-alpha-1
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-41963?
CVE-2022-41963 is a vulnerability in the BigBlueButton web conferencing system that allows attackers to take actions in the few seconds after their access is revoked.
What is the severity of CVE-2022-41963?
CVE-2022-41963 has a severity level of low with a severity score of 3.1.
How does CVE-2022-41963 affect BigBlueButton?
CVE-2022-41963 affects BigBlueButton versions prior to 2.4.3, allowing attackers to exploit the whiteboard grace period to take actions after their access is revoked.
How can I fix CVE-2022-41963?
To fix CVE-2022-41963, it is recommended to upgrade your BigBlueButton version to 2.4.3 or later.
Where can I find more information about CVE-2022-41963?
You can find more information about CVE-2022-41963 at the following references: [GitHub Release](https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3), [GitHub Security Advisory](https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6p9-926c-6qfp).