CVE-2022-29234 MEDIUM

CVE-2022-29234: Grace period for lock settings in public/private chats in BigBlueButton

Vendor Bigbluebutton
Product bigbluebutton
Weakness CWE-285
Published June 1, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4.1, an attacker could send messages to a locked chat within a grace period of 5s any lock setting in the meeting was changed. The attacker needs to be a participant in the meeting. Versions 2.3.18 and 2.4.1 contain a patch for this issue. There are currently no known workarounds.

Key dates

02Disclosure timeline

June 1, 2022 CVE published
April 23, 2025 Record updated