{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "cpe": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*",
            "extracted_events": [
              {
                "introduced": "2.2.0"
              },
              {
                "fixed": "2.3.9"
              }
            ],
            "source": [
              "CPE_RANGE",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "68e35c9d722e62892d2e885646a9eab3bf44f77d"
            },
            {
              "fixed": "3e497e2d457833f0243743717731dfc765d987fd"
            },
            {
              "fixed": "369cd2516534848155de35bcdcea50c8eab7d6a8"
            }
          ],
          "repo": "https://github.com/bigbluebutton/bigbluebutton",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-3fqh-p4qr-vfm9"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29232.json"
  },
  "details": "BigBlueButton is an open source web conferencing system. Starting with version 2.2 and prior to versions 2.3.9 and 2.4-beta-1, an attacker can circumvent access controls to obtain the content of public chat messages from different meetings on the server. The attacker must be a participant in a meeting on the server. BigBlueButton versions 2.3.9 and 2.4-beta-1 contain a patch for this issue. There are currently no known workarounds.",
  "id": "CVE-2022-29232",
  "modified": "2026-07-15T01:48:54.540841412Z",
  "published": "2022-06-01T22:25:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.3.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-beta-1"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29232.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-3fqh-p4qr-vfm9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29232"
    },
    {
      "type": "FIX",
      "url": "https://github.com/bigbluebutton/bigbluebutton/pull/12861"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Exposure of messages in BigBlueButton public chats"
}