Vulnerability Details CVE-2022-29234
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 53.6%
CVSS Severity
CVSS v3 Score 4.3
CVSS v2 Score 4.0
References
- https://github.com/bigbluebutton/bigbluebutton/pull/13850
- https://github.com/bigbluebutton/bigbluebutton/pull/14265
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.1
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-36vc-c338-6xjv
- https://github.com/bigbluebutton/bigbluebutton/pull/13850
- https://github.com/bigbluebutton/bigbluebutton/pull/14265
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.1
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-36vc-c338-6xjv
Products affected by CVE-2022-29234
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.0
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.1
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.10
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.11
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.12
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.14
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.15
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.16
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.17
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.18
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.19
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.2
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.20
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.21
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.22
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.23
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.24
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.25
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.26
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.27
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.28
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.29
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.3
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.30
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.31
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.4
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.5
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.6
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.7
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.8
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.9
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.0
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.1
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.10
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.11
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.12
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.13
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.14
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.15
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.16
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.17
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.2
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.3
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.4
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.5
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.6
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.7
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.8
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.9
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4.0