CVE-2022-29236

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-29236
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29236.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-29236
Aliases
  • GHSA-p93g-r9gm-9v6r
Published
2022-06-01T23:25:12Z
Modified
2025-12-04T10:21:34.843494Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Improper access control for pencil annotations in BigBlueButton
Details

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced grace period. The attacker must be a meeting participant. The problem has been patched in versions 2.3.18 and 2.4-rc-6. There are currently no known workarounds.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-285"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29236.json"
}
References

Affected packages

Git / github.com/bigbluebutton/bigbluebutton

Affected ranges

Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
68e35c9d722e62892d2e885646a9eab3bf44f77d
Fixed
0bcb8c2b9e850b99faae7fcfb3d1014e64bff97d
Database specific 
{
    "versions": [
        {
            "introduced": "2.2"
        },
        {
            "fixed": "2.3.18"
        }
    ]
}
Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
f037f0a259dd4e6e41e095a5ca4adcb2666bb8dc
Fixed
07cfcd376a44aceb543bcb8f098cf34d73b6b8bf
Database specific 
{
    "versions": [
        {
            "introduced": "2.4-alpha-1"
        },
        {
            "fixed": "2.4-rc-6"
        }
    ]
}

Affected versions

2.*

2.4-rc-2

v2.*

v2.3.10
v2.3.11
v2.3.12
v2.3.13
v2.3.14
v2.3.5
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4-alpha-1
v2.4-alpha-2
v2.4-beta-1
v2.4-beta-2
v2.4-beta-3
v2.4-beta-4
v2.4-rc-1
v2.4-rc-3
v2.4-rc-4
v2.4-rc-5