CVE-2022-23488 affects BigBlueButton versions prior to 2.4-rc-6, allowing unauthorized access to viewers' webcams despite the "moderators-only webcams lock" setting being enabled. This high-severity vulnerability (CVSS 7.5) has a low attack complexity and could lead to significant information disclosure (CWE-200, CWE-201). There is no known active exploitation, publicly available exploit code, or significant community discussion, and no workarounds exist beyond upgrading to the patched version.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.4CPE matchmatch criteria | cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:* | ||
2.4CPE matchmatch criteria | cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha1:*:*:*:*:*:* | ||
2.4CPE matchmatch criteria | cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:alpha2:*:*:*:*:*:* | ||
2.4CPE matchmatch criteria | cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta1:*:*:*:*:*:* | ||
2.4CPE matchmatch criteria | cpe:2.3:a:bigbluebutton:bigbluebutton:2.4:beta2:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.