Vulnerability · Published Jun 27, 2022 · Assigned by GitHub_M

CVE-2022-31065Cross site scripting vulnerability for private chat in bigbluebutton

Medium 6.5

In plain English

A medium-severity cross-site scripting in bigbluebutton from bigbluebutton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.8%top 43.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker (whose username contains malicious JavaScript), the script gets executed. Additionally when the victim receives a notification that the attacker has left the session. This issue has been patched in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.

Affected products (as reported)

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< 2.4.8

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

References

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8m2p-7qv3-qff7 x_refsource_CONFIRM
https://github.com/bigbluebutton/bigbluebutton/pull/15087 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/pull/15090 x_refsource_MISC