DeutschShown in its original language — a full translation is planned for a future version.
BigBlueButton: Mehrere Schwachstellen
view advisory published 2022-12-15
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in BigBlueButton ausnutzen, um Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen, Daten zu manipulieren und Sicherheitsmaßnahmen zu umgehen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-23488US | high7.5OT elevated | — | ||
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams… | ||||
| CVE-2022-23490US | medium4.3OT elevated | — | ||
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where… | ||||
| CVE-2022-41964US | medium5.7 | — | ||
BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll res… | ||||
| CVE-2022-41963US | low3.1 | — | ||
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period cou… | ||||
| CVE-2022-41962US | low2.7OT elevated | — | ||
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator… | ||||
| CVE-2022-41961US | medium4.3OT elevated | — | ||
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the m… | ||||
| CVE-2022-41960US | medium4.3OT elevated | — | ||
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An… | ||||
02
references
External citations — patches, advisories, analysis.
- Github Bigbluebutton vom 2022-12-15external
- Github Bigbluebutton vom 2022-12-15external
- Github Bigbluebutton vom 2022-12-15external
- Github Bigbluebutton vom 2022-12-15external
- Github Bigbluebutton vom 2022-12-15external
- Github Bigbluebutton vom 2022-12-15external
- WID-SEC-W-2022-2350 - CSAF Versionself
- WID-SEC-2022-2350 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan