CVE-2023-43797

2023-10-3023:15:08

CWE-79

[email protected]

web.nvd.nist.gov

bigbluebutton

virtual classroom

xss

vulnerability

nvd

cve-2023-43797

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

0.001 Low

EPSS

Percentile

21.3%

JSON

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.

Affected configurations

Vulners

NVD

Node

bigbluebuttonbigbluebuttonRange<2.6.11

bigbluebuttonbigbluebuttonRange2.7.0-alpha.1–2.7.0-beta.3

VendorProductVersionCPE
bigbluebuttonbigbluebutton*cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*
bigbluebuttonbigbluebutton*cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bigbluebutton	bigbluebutton	*	cpe:2.3:a:bigbluebutton:bigbluebutton::::::::
bigbluebutton	bigbluebutton	*	cpe:2.3:a:bigbluebutton:bigbluebutton::::::::

CNA Affected

[
  {
    "vendor": "bigbluebutton",
    "product": "bigbluebutton",
    "versions": [
      {
        "version": "< 2.6.11",
        "status": "affected"
      },
      {
        "version": ">= 2.7.0-alpha.1, < 2.7.0-beta.3",
        "status": "affected"
      }
    ]
  }
]