cnvd - cnvd-2022-82637

cnvd-2022-82637

Vulnerability from cnvd

Title: BigBlueButton授权问题漏洞（CNVD-2022-82637）

Description:

BigBlueButton是BigBlueButton社区的一套开源的Web会议系统。

BigBlueButton存在授权问题漏洞，攻击者可利用该漏洞绕过访问控制来访问他们所在的会议的所有分离室。

Severity: 中

Patch Name: BigBlueButton授权问题漏洞（CNVD-2022-82637）的补丁

Patch Description:

BigBlueButton是BigBlueButton社区的一套开源的Web会议系统。

BigBlueButton存在授权问题漏洞，攻击者可利用该漏洞绕过访问控制来访问他们所在的会议的所有分离室。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1

Reference: https://nvd.nist.gov/vuln/detail/CVE-2022-29233

Impacted products

Name
['BigBlueButton BigBlueButton >=2.2，<=2.3.18', 'BigBlueButton BigBlueButton <2.4-rc-1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-29233",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-29233"
    }
  },
  "description": "BigBlueButton\u662fBigBlueButton\u793e\u533a\u7684\u4e00\u5957\u5f00\u6e90\u7684Web\u4f1a\u8bae\u7cfb\u7edf\u3002\n\nBigBlueButton\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u8bbf\u95ee\u63a7\u5236\u6765\u8bbf\u95ee\u4ed6\u4eec\u6240\u5728\u7684\u4f1a\u8bae\u7684\u6240\u6709\u5206\u79bb\u5ba4\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2022-82637",
  "openTime": "2022-11-29",
  "patchDescription": "BigBlueButton\u662fBigBlueButton\u793e\u533a\u7684\u4e00\u5957\u5f00\u6e90\u7684Web\u4f1a\u8bae\u7cfb\u7edf\u3002\r\n\r\nBigBlueButton\u5b58\u5728\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u8bbf\u95ee\u63a7\u5236\u6765\u8bbf\u95ee\u4ed6\u4eec\u6240\u5728\u7684\u4f1a\u8bae\u7684\u6240\u6709\u5206\u79bb\u5ba4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "BigBlueButton\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2022-82637\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "BigBlueButton BigBlueButton \u003e=2.2\uff0c\u003c=2.3.18",
      "BigBlueButton BigBlueButton \u003c2.4-rc-1"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-29233",
  "serverity": "\u4e2d",
  "submitTime": "2022-06-06",
  "title": "BigBlueButton\u6388\u6743\u95ee\u9898\u6f0f\u6d1e\uff08CNVD-2022-82637\uff09"
}

CVE-2022-29233 (GCVE-0-2022-29233)

Vulnerability from cvelistv5

Published

2022-06-01 23:15

Modified

2025-04-23 18:20

Severity ?

4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-285 - Improper Authorization

Summary

BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.

References

▼	URL	Tags
	https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33	x_refsource_CONFIRM
	https://github.com/bigbluebutton/bigbluebutton/pull/13117	x_refsource_MISC
	https://github.com/bigbluebutton/bigbluebutton/pull/14265	x_refsource_MISC
	https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18	x_refsource_MISC
	https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	bigbluebutton	bigbluebutton	Version: >= 2.2, < 2.3.18 Version: >= 2.4-alpha-1, < 2.4-rc-1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T06:17:54.102Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/bigbluebutton/bigbluebutton/pull/13117"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/bigbluebutton/bigbluebutton/pull/14265"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-29233",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-23T14:06:20.431295Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T18:20:17.607Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "bigbluebutton",
          "vendor": "bigbluebutton",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.2, \u003c 2.3.18"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.4-alpha-1, \u003c 2.4-rc-1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-06-01T23:15:15.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bigbluebutton/bigbluebutton/pull/13117"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bigbluebutton/bigbluebutton/pull/14265"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1"
        }
      ],
      "source": {
        "advisory": "GHSA-3mr9-p9gw-cf33",
        "discovery": "UNKNOWN"
      },
      "title": "Improper access control for breakout rooms in BigBlue Button",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2022-29233",
          "STATE": "PUBLIC",
          "TITLE": "Improper access control for breakout rooms in BigBlue Button"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "bigbluebutton",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 2.2, \u003c 2.3.18"
                          },
                          {
                            "version_value": "\u003e= 2.4-alpha-1, \u003c 2.4-rc-1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "bigbluebutton"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285: Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33",
              "refsource": "CONFIRM",
              "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33"
            },
            {
              "name": "https://github.com/bigbluebutton/bigbluebutton/pull/13117",
              "refsource": "MISC",
              "url": "https://github.com/bigbluebutton/bigbluebutton/pull/13117"
            },
            {
              "name": "https://github.com/bigbluebutton/bigbluebutton/pull/14265",
              "refsource": "MISC",
              "url": "https://github.com/bigbluebutton/bigbluebutton/pull/14265"
            },
            {
              "name": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18",
              "refsource": "MISC",
              "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18"
            },
            {
              "name": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1",
              "refsource": "MISC",
              "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-3mr9-p9gw-cf33",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-29233",
    "datePublished": "2022-06-01T23:15:15.000Z",
    "dateReserved": "2022-04-13T00:00:00.000Z",
    "dateUpdated": "2025-04-23T18:20:17.607Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted