CVE-2022-41964

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-41964
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41964.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-41964
Aliases
  • GHSA-fgmj-rx7j-fqr4
Published
2022-12-16T17:17:15.394Z
Modified
2026-04-10T04:51:38.721647Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
BigBlueButton contains Response leaks in anonymous polls
Details

BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll. The attacker had to be a meeting presenter. This issue is patched in version 2.4.0. There are no workarounds.

Database specific 
{
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41964.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/bigbluebutton/bigbluebutton

Affected ranges

Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
72d5e54e3eb3cd442d23dc097158fe81f1efda82
Type
GIT
Repo
https://github.com/bigbluebutton/bigbluebutton
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
72d5e54e3eb3cd442d23dc097158fe81f1efda82

Affected versions

2.*
2.2-beta-10
2.2-beta-11
2.2-beta-12
2.2-beta-14
2.2-beta-15
2.2-beta-16
2.2-beta-17
2.2-beta-18
2.2-beta-19
2.2-beta-2
2.2-beta-20
2.2-beta-21
2.2-beta-22
2.2-beta-23
2.2-beta-3
2.2-beta-4
2.2-beta-5
2.2-beta-6
2.2-beta-7
2.2-beta-8
2.2-beta-9
2.2-rc-1
2.2-rc-2
2.2-rc-3
2.4-rc-2
Other
dcs-2-a
v0.*
v0.8
v0.8b4
v0.8b4.0
v0.8rc2
v0.9.0-beta
v2.*
v2.3-alpha-1
v2.3-alpha-2
v2.3-alpha-3
v2.3-alpha-4
v2.3-alpha-5
v2.3-alpha-6
v2.3-alpha-7
v2.3-alpha-8
v2.3-beta-1
v2.3-beta-2
v2.3-beta-3
v2.3-beta-4
v2.3-beta-5
v2.3-rc-1
v2.3-rc-2
v2.3.0
v2.3.1
v2.4-alpha-1
v2.4-beta-1
v2.4-beta-2
v2.4-beta-3
v2.4-beta-4
v2.4-rc-1
v2.4-rc-3
v2.4-rc-4
v2.4-rc-5
v2.4-rc-6
v2.4-rc-7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-41964.json"