CVE-2022-41963
BigBlueButton contains Improper Preservation of Permissions for whiteboard
Vexday Risk Score
8Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 2.7EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
16 dic 2022Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a meeting participant. This issue is patched in version 2.4.3 an version 2.5-alpha-1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Productos afectados
bigbluebutton · bigbluebutton¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →