CVE-2022-27238

BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality

published June 24, 2022

CVSS
—
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to the victim or when notification about the attacker leaving room is displayed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Published
2022-06-24T15:15Z
EPSS history
Timeline
  • 24 JUN 15:15Z
    BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality
    cvelistv5