CVE-2022-41964: BigBlueButton contains Response leaks in anonymous polls

Published Dec 16, 2022

Updated

BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll. The attacker had to be a meeting presenter. This issue is patched in version 2.4.0. There are no workarounds.

Affected Software

13 affected components

BigBlueButton BigBlueButton=2.4-alpha1

BigBlueButton BigBlueButton=2.4-alpha2

BigBlueButton BigBlueButton=2.4-beta1

BigBlueButton BigBlueButton=2.4-beta2

BigBlueButton BigBlueButton=2.4-beta3

BigBlueButton BigBlueButton=2.4-beta4

BigBlueButton BigBlueButton=2.4-rc1

BigBlueButton BigBlueButton=2.4-rc2

BigBlueButton BigBlueButton=2.4-rc3

BigBlueButton BigBlueButton=2.4-rc4

BigBlueButton BigBlueButton=2.4-rc5

BigBlueButton BigBlueButton=2.4-rc6

BigBlueButton BigBlueButton=2.4-rc7

Remediation

Patch Available

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4

Event History

Dec 16, 2022

CVE Published

via MITRE·05:17 PM

Data Sourced

via MITRE·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-41964?

CVE-2022-41964 is a vulnerability in BigBlueButton 2.4 release candidates that allows an attacker to see individual responses in an anonymous poll.

How does CVE-2022-41964 affect BigBlueButton?

CVE-2022-41964 affects release candidates of BigBlueButton 2.4.

What is the severity of CVE-2022-41964?

The severity of CVE-2022-41964 is medium with a CVSS score of 5.7.

How can I fix CVE-2022-41964?

To fix CVE-2022-41964, upgrade to BigBlueButton 2.4 release or later.

Where can I find more information about CVE-2022-41964?

You can find more information about CVE-2022-41964 in the advisory on the GitHub security page of BigBlueButton.