Cross site scripting

2023-10-3023:15:00

PRIOn knowledge base

www.prio-n.com

bigbluebutton

virtual classroom

cross-site scripting

vulnerability

guest lobby

unsanitized messages

text sanitizing

nvd

0.001 Low

EPSS

Percentile

21.3%

JSON

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.

CPENameOperatorVersion
bigbluebuttoneq2.7.0 beta2
bigbluebuttoneq2.7.0 beta1
bigbluebuttoneq2.7.0 alpha1
bigbluebuttoneq2.7.0 alpha2
bigbluebuttoneq2.7.0 alpha3
bigbluebuttonlt2.6.11

Name	Operator	Version
bigbluebutton	eq	2.7.0 beta2
bigbluebutton	eq	2.7.0 beta1
bigbluebutton	eq	2.7.0 alpha1
bigbluebutton	eq	2.7.0 alpha2
bigbluebutton	eq	2.7.0 alpha3
bigbluebutton	lt	2.6.11