CVE-2022-41962CWE-863

BigBlueButton contains Incorrect Authorization for setting emoji status

Low · published December 16, 2022

CVSS v3.1
2.7
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. Moderators should only be able to set none as the status of other users. This issue is patched in 2.4-rc-6 and 2.5-alpha-1There are no workarounds.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00711 · 53.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2022-12-16T12:45Z
EPSS history
Timeline
  • 16 DEC 12:45Z
    BigBlueButton contains Incorrect Authorization for setting emoji status
    cvelistv5