CVE-2022-23490

MEDIUM

BigBlueButton < 2.4.0 - Unauthorized Poll Response Exposure via Current-Poll Collection

Title source: llm
STIX 2.1

Description

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.0 expose sensitive information to Unauthorized Actors. This issue affects meetings with polls, where the attacker is a meeting participant. Subscribing to the current-poll collection does not update the client UI, but does give the attacker access to the contents of the collection, which include the individual poll responses. This issue is patched in version 2.4.0. There are no workarounds.

References (2)

Core 2
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0

Scores

CVSS v3 4.3
EPSS 0.0043
EPSS Percentile 34.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200 CWE-863
Status published
Products (1)
bigbluebutton/bigbluebutton < 2.4.0
Published Dec 16, 2022
Tracked Since Feb 18, 2026