VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jun 2, 2022· Updated Jun 17, 2026

CVE-2022-29236

CVE-2022-29236

Description

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced grace period. The attacker must be a meeting participant. The problem has been patched in versions 2.3.18 and 2.4-rc-6. There are currently no known workarounds.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

13
  • Bigbluebutton/Bigbluebutton13 versions
    cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 12 more
    • cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: >=2.2.0,<2.3.18
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta1:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta2:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta3:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta4:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc1:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc3:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc4:*:*:*:*:*:*
    • cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:rc5:*:*:*:*:*:*
    • (no CPE)range: >=2.2, <2.3.18, <2.4-rc-6
    • (no CPE)range: >= 2.2, < 2.3.18

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.