VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jun 2, 2022· Updated Jun 17, 2026

CVE-2022-29235

CVE-2022-29235

Description

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

13
  • Bigbluebutton/Bigbluebutton13 versions
    cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 12 more
    • cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: >=2.2.0,<2.3.18
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta1:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta2:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta3:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta4:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc1:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc3:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc4:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc5:*:*:*:*:*:*
    • (no CPE)range: >=2.2, <2.3.18, <2.4-rc-6
    • (no CPE)range: >= 2.2, < 2.3.18

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.