CVE-2022-23488 MEDIUM

CVE-2022-23488: BigBlueButton vulnerable to Insertion of Sensitive Information Into Sent Data

Vendor Bigbluebutton
Product bigbluebutton
Weakness CWE-201
Published December 17, 2022
Last update April 17, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are vulnerable to Insertion of Sensitive Information Into Sent Data. The moderators-only webcams lock setting is not enforced on the backend, which allows an attacker to subscribe to viewers' webcams, even when the lock setting is applied. (The required streamId was being sent to all users even with lock setting applied). This issue is fixed in version 2.4-rc-6. There are no workarounds.

Key dates

02Disclosure timeline

December 17, 2022 CVE published
April 17, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-39711 WordPress RT-Theme 18 | Extensions plugin <= 2.5 - Sensitive Data Exposure vulnerability CVE-2026-54197 WordPress GetGenie plugin <= 4.4.1 - Sensitive Data Exposure vulnerability CVE-2026-42384 WordPress Simply Schedule Appointments plugin < 1.6.11.2 - Sensitive Data Exposure vulnerability CVE-2026-41181 Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service CVE-2026-4525 Vault Token Leaked to Backends via Authorization: Bearer Passthrough Header