CVE-2022-41960: falha de média gravidade em bigbluebutton
BigBlueButton contains DoS via failed authToken validation
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.4%
BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to `validateAuthToken` using a victim's userId, meetingId, and an invalid authToken. This forces the victim to leave the conference, because the resulting verification failure is also observed and handled by the victim's client. The attacker must be a participant in any meeting on the server. This issue is patched in version 2.4.3. There are no workarounds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
bigbluebutton · bigbluebuttonCVEs relacionadas — bigbluebutton
No mesmo produto, das mais perigosas para as menos.
CVE-2022-29169HIGHReDoS on endpoint html5client/useragent in BigBlueButtonEPSS 1.6%CVE-2022-31064MEDIUMCross site scripting in username that will trigger by sending chatEPSS 1.3%CVE-2022-29232MEDIUMExposure of messages in BigBlueButton public chatsEPSS 1.1%CVE-2022-29235MEDIUMLimited data exposure for shared external videos in BigBlueButtonEPSS 1.1%CVE-2022-29233MEDIUMImproper access control for breakout rooms in BigBlue ButtonEPSS 1.1%CVE-2022-29236MEDIUMImproper access control for pencil annotations in BigBlueButtonEPSS 0.9%