CVE-2022-29235 Limited data exposure for shared external videos in BigBlueButton
An attacker with a meeting ID can view external video playback status, requiring an upgrade to BigBlueButton to fix.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-29235?
CVE-2022-29235 is a medium-severity vulnerability in bigbluebutton, published on 1 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds.
Weakness: CWE-200
Which versions are affected by CVE-2022-29235?
It affects 1 product.
Products include Bigbluebutton Bigbluebutton.
How do I fix CVE-2022-29235?
No fix has been published for CVE-2022-29235 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-29235 being exploited?
There is no known exploitation of CVE-2022-29235 in the wild and no public exploit code.
Other vulnerabilities in bigbluebutton
Sources
Also known as GHSA-x82p-j22f-v4q6.