What is CVE-2022-41963?

CVE-2022-41963 is a low-severity vulnerability in Bigbluebutton, classified under Improper Preservation of Permissions. CVSS score: 2.7/10. Published 2022-12-16.

How severe is CVE-2022-41963?

Low severity. CVSS v3 base score is 2.7 out of 10.

Vulnerability in Bigbluebutton

CVE-2022-41963

BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a meeting participant. This issue is patched in version 2.4.3 an version 2.5-alpha-1

EPSS: 0.004 (34.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N.

Affected products

Bigbluebutton — versions < 2.4.3

Weakness classification (CWE)

CWE-281 — Improper Preservation of Permissions

References

security-advisories@github.com (x_refsource_CONFIRM, Patch, Third Party Advisory, Release Notes)
security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2022-41963?: CVE-2022-41963 is a low-severity vulnerability in Bigbluebutton, classified under Improper Preservation of Permissions. CVSS score: 2.7/10. Published 2022-12-16.
How severe is CVE-2022-41963?: Low severity. CVSS v3 base score is 2.7 out of 10.