CVE-2023-43797CWE-79

BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby

Medium · published October 30, 2023

CVSS v3.1
6.3
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00418 · 35.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-10-30T22:18Z
EPSS history
Timeline
  • 30 OCT 22:18Z
    BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
    cvelistv5