Medium severity · published Dec 16, 2022
CVE-2022-41961
BigBlueButton subject to Ineffective user bans
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the meeting with the remaining registered users from the same extId. This issue has been fixed by improving permissions such that banning a user removes all users related to their extId, including registered users that have not joined the meeting. This issue is patched in versions 2.4-rc-6 and 2.5-alpha-1. There are no workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
bigbluebutton · bigbluebutton
< v2.4-rc-6 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41961
Release Notes
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6
Release Notes
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1
Patch
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wxjp-h88g-7fqg
More from bigbluebutton
9.8
CVE-2020-27605
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
9.8
CVE-2020-27602
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken
9.8
CVE-2020-12443
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case)…
8.8
CVE-2023-42803
BigBlueButton Unrestricted File Upload vulnerability
8.5
CVE-2026-46682
BigBlueButton: Blind SQL Injection AUTH (Moderator)