CVE-2022-29234CWE-285

Grace period for lock settings in public/private chats in BigBlueButton

Medium · published June 1, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
57.8
In the wild
Unconfirmed
What it is

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00850 · 57.8th percentile
Weakness
CWE-285 · Improper Authorization
Published
2022-06-01T23:20Z
EPSS history
Timeline
  • 01 JUN 23:20Z
    Grace period for lock settings in public/private chats in BigBlueButton
    cvelistv5