CVE-2022-29235

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-29235
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29235.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-29235
Aliases
  • GHSA-x82p-j22f-v4q6
Published
2022-06-01T23:25:18Z
Modified
2025-12-04T10:21:36.030654Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Limited data exposure for shared external videos in BigBlueButton
Details

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29235.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/bigbluebutton/bigbluebutton

Affected ranges

Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
68e35c9d722e62892d2e885646a9eab3bf44f77d
Fixed
0bcb8c2b9e850b99faae7fcfb3d1014e64bff97d
Database specific 
{
    "versions": [
        {
            "introduced": "2.2"
        },
        {
            "fixed": "2.3.18"
        }
    ]
}
Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
f037f0a259dd4e6e41e095a5ca4adcb2666bb8dc
Fixed
07cfcd376a44aceb543bcb8f098cf34d73b6b8bf
Database specific 
{
    "versions": [
        {
            "introduced": "2.4-alpha-1"
        },
        {
            "fixed": "2.4-rc-6"
        }
    ]
}

Affected versions

2.*

2.4-rc-2

v2.*

v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4-alpha-1
v2.4-alpha-2
v2.4-beta-1
v2.4-beta-2
v2.4-beta-3
v2.4-beta-4
v2.4-rc-1
v2.4-rc-3
v2.4-rc-4
v2.4-rc-5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29235.json"