Low severity · published Dec 16, 2022
CVE-2022-41963
BigBlueButton is an open source web conferencing system
3.1
CVSS
0.5%
EPSS
No
On KEV
Description
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a meeting participant. This issue is patched in version 2.4.3 an version 2.5-alpha-1
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Bigbluebutton · Bigbluebutton
before 2.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41963
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41963
Release Notes
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3
Patch
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6p9-926c-6qfp
More from Bigbluebutton
9.8
CVE-2020-27605
BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
9.8
CVE-2020-27602
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken
9.8
CVE-2020-12443
BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case)…
8.8
CVE-2023-42803
BigBlueButton Unrestricted File Upload vulnerability
8.5
CVE-2026-46682
BigBlueButton: Blind SQL Injection AUTH (Moderator)