CVE-2022-29233

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-29233
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29233.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-29233
Aliases
  • GHSA-3mr9-p9gw-cf33
Published
2022-06-01T23:15:15Z
Modified
2025-12-04T10:21:34.585629Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Improper access control for breakout rooms in BigBlue Button
Details

BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.

Database specific 
{
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29233.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/bigbluebutton/bigbluebutton

Affected ranges

Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
68e35c9d722e62892d2e885646a9eab3bf44f77d
Fixed
0bcb8c2b9e850b99faae7fcfb3d1014e64bff97d
Database specific 
{
    "versions": [
        {
            "introduced": "2.2"
        },
        {
            "fixed": "2.3.18"
        }
    ]
}
Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
f037f0a259dd4e6e41e095a5ca4adcb2666bb8dc
Fixed
8263bb2103a8655a0611e54d03446f855211b85b
Database specific 
{
    "versions": [
        {
            "introduced": "2.4-alpha-1"
        },
        {
            "fixed": "2.4-rc-1"
        }
    ]
}

Affected versions

v2.*

v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4-alpha-1
v2.4-alpha-2
v2.4-beta-1
v2.4-beta-2
v2.4-beta-3
v2.4-beta-4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29233.json"