CVE-2022-23488

HIGH
Published Dec 17, 20223y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Dec 17, 2022 3y ago
Last Modified Jun 17, 2026 2w ago

Description

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied. (The required streamId was being sent to all users even with lock setting applied). This issue is fixed in version 2.4-rc-6. There are no workarounds.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 3

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Information Exposure
CWE-201
CWE-863 Incorrect Authorization Authorization

Affected Products 12

VendorProductVersionRange
bigbluebuttonbigbluebutton* <2.4
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any
bigbluebuttonbigbluebutton2.4any

References 2

  • github.com https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6
    Release NotesThird Party Advisory
  • github.com https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5g3-f74q-rvfq
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-j5g3-f74q-rvfq
    PatchThird Party Advisory