« Volver al listado

CVE-2022-29235

Estado: ModificadaMedia (5.3)—

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Bigbluebutton — Bigbluebutton

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-29235",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "bigbluebutton",
          "product": "bigbluebutton",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.2, < 2.3.18"
            },
            {
              "status": "affected",
              "version": ">= 2.4-alpha-1, < 2.4-rc-6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-06-02T00:15:08.390",
  "references": [
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/pull/13788",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/pull/14265",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x82p-j22f-v4q6",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/pull/13788",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/pull/14265",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x82p-j22f-v4q6",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds."
    },
    {
      "lang": "es",
      "value": "BigBlueButton es un sistema de conferencias web de código abierto. A partir de la versión 2.2 y versiones hasta 2.3.18 y 2.4-rc-6, un atacante que sea capaz de obtener el identificador de una reunión en un servidor puede encontrar información relacionada con un vídeo externo que esta siendo compartiendo, como la marca de tiempo actual y la reproducción/pausa. El problema ha sido parcheado en versiones 2.3.18 y 2.4-rc-6, al modificar el flujo para enviar los datos sólo para usuarios de la reunión. Actualmente no son conocidas mitigaciones"
    }
  ],
  "lastModified": "2026-06-17T04:39:53.330",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60814A0D-57C0-4407-B7DD-26A9D5C3DBB1",
              "versionEndExcluding": "2.3.18",
              "versionStartIncluding": "2.2.0"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C136F53E-2EC5-433F-B354-88DA37689142"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "626A8774-BC38-4F11-A16B-918EC8740C82"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33735D00-C2AC-4FDA-B47B-B15D099F26F3"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98890F0C-2E60-4696-A6E5-F44FB2A1A5BD"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C916210-11BF-4F4C-AE3E-29D27135F3F9"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABB37B70-021E-48F6-B3D2-0790A4729A3C"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "407E0358-75E5-41D9-A624-3C15D2145DDE"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EC135064-4919-4759-BC25-34C7868F6431"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0173198-BFAB-49E5-898E-173503C452C2"
            },
            {
              "criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCB8C413-ECD9-47BF-963C-B3A0F25A1BD8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}