Medium severity4.3NVD Advisory· Published Jun 2, 2022· Updated Jun 17, 2026
CVE-2022-29233
CVE-2022-29233
Description
BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather than on verification of the role of the user. Versions 2.3.18 and 2.4-rc-1 contain a patch for this issue. There are currently no known workarounds.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
9cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: >=2.2.0,<2.3.18
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha1:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha2:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta1:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta2:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta3:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta4:*:*:*:*:*:*
- (no CPE)range: 2.2 - 2.3.17, 2.4-rc-1
- (no CPE)range: >= 2.2, < 2.3.18
Patches
Vulnerability mechanics
References
5- github.com/bigbluebutton/bigbluebutton/pull/13117nvdPatchThird Party Advisory
- github.com/bigbluebutton/bigbluebutton/pull/14265nvdPatchThird Party Advisory
- github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3mr9-p9gw-cf33nvdPatchThird Party Advisory
- github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18nvdRelease NotesThird Party Advisory
- github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-1nvdRelease NotesThird Party Advisory
News mentions
0No linked articles in our index yet.