Vulnerability · Published Oct 30, 2023 · Assigned by GitHub_M

CVE-2023-43797BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby

Medium 6.3

In plain English

A medium-severity cross-site scripting in bigbluebutton from bigbluebutton. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.5%top 59.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.

Affected products (as reported)

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< 2.6.11>= 2.7.0-alpha.1, < 2.7.0-beta.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73x x_refsource_CONFIRM
https://github.com/bigbluebutton/bigbluebutton/pull/18392 x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d x_refsource_MISC