BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collection does not update the client UI, but does give the attacker access to the contents of the collection, which include the individual poll responses. This issue is patched in version 2.4.0. There are no workarounds.
References
Link | Resource |
---|---|
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0 | Release Notes Third Party Advisory |
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-4qgc-xhw5-6qfg | Patch Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: GitHub_M
Published: 2022-12-16T21:02:30.109Z
Updated:
Reserved: 2022-01-19T21:23:53.762Z
Link: CVE-2022-23490
JSON object: View
NVD Information
Status : Modified
Published: 2022-12-16T22:15:08.743
Modified: 2023-11-07T03:44:10.580
Link: CVE-2022-23490
JSON object: View
Redhat Information
No data.