CVE-2022-41964: BigBlueButton contains Response leaks in anonymous polls

Severity: medium (CVSS 5.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-16 · updated 2026-06-17
Weakness: CWE-200

Description

BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll. The attacker had to be a meeting presenter. This issue is patched in version 2.4.0. There are no workarounds.

Affected products

bigbluebutton: 2.4-alpha1, 2.4-alpha2, 2.4-beta1, 2.4-beta2, 2.4-beta3, 2.4-beta4 (+7)

References

https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4
https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4

Get alerted when CVE-2022-41964 or the next vulnerability affects your stack