BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.
References
| Link | Resource |
|---|---|
| https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d | Patch Third Party Advisory |
| https://github.com/bigbluebutton/bigbluebutton/pull/18392 | Third Party Advisory |
| https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73x | Third Party Advisory |
| https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d | Patch Third Party Advisory |
| https://github.com/bigbluebutton/bigbluebutton/pull/18392 | Third Party Advisory |
| https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73x | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:24
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d - Patch, Third Party Advisory | |
| References | () https://github.com/bigbluebutton/bigbluebutton/pull/18392 - Third Party Advisory | |
| References | () https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73x - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.3 |
07 Nov 2023, 23:08
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:bigbluebutton:bigbluebutton:2.7.0:beta1:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.7.0:alpha3:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.7.0:beta2:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.7.0:alpha2:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.7.0:alpha1:*:*:*:*:*:* |
|
| First Time |
Bigbluebutton
Bigbluebutton bigbluebutton |
|
| References | (MISC) https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73x - Third Party Advisory | |
| References | (MISC) https://github.com/bigbluebutton/bigbluebutton/pull/18392 - Third Party Advisory | |
| References | (MISC) https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d - Patch, Third Party Advisory |
30 Oct 2023, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-30 23:15
Updated : 2024-11-21 08:24
NVD link : CVE-2023-43797
Mitre link : CVE-2023-43797
CVE.ORG link : CVE-2023-43797
JSON object : View
Products Affected
bigbluebutton
- bigbluebutton
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')