Description
BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp and play/pause. The problem has been patched in versions 2.3.18 and 2.4-rc-6 by modifying the stream to send the data only for users in the meeting. There are currently no known workarounds.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
bigbluebutton bigbluebutton
>= 2.2, < 2.3.18affected>= 2.4-alpha-1, < 2.4-rc-6affected
References
- https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-x82p-j22f-v4q6 ↗
- https://github.com/bigbluebutton/bigbluebutton/pull/13788 ↗
- https://github.com/bigbluebutton/bigbluebutton/pull/14265 ↗
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.18 ↗
- https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 ↗