CVE-2023-43797mediumCWE-79

CVE-2023-43797: medium-severity vulnerability in bigbluebutton

BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby

Published · Updated

Follow this CVE+ Monitor bigbluebutton

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.5%
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
bigbluebutton · bigbluebutton
Related CVEs — bigbluebutton

In the same product, most dangerous first.

CVE-2022-29169HIGHReDoS on endpoint html5client/useragent in BigBlueButtonEPSS 1.6%CVE-2022-31064MEDIUMCross site scripting in username that will trigger by sending chatEPSS 1.3%CVE-2022-29232MEDIUMExposure of messages in BigBlueButton public chatsEPSS 1.1%CVE-2022-29235MEDIUMLimited data exposure for shared external videos in BigBlueButtonEPSS 1.1%CVE-2022-29233MEDIUMImproper access control for breakout rooms in BigBlue ButtonEPSS 1.1%CVE-2022-29236MEDIUMImproper access control for pencil annotations in BigBlueButtonEPSS 0.9%