CVE-2022-31064 Cross site scripting in username that will trigger by sending chat

2022-06-2719:50:14

CWE-79

GitHub_M

www.cve.org

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

0.002 Low

EPSS

Percentile

59.6%

JSON

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim’s client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.

CNA Affected

[
  {
    "product": "bigbluebutton",
    "vendor": "bigbluebutton",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.4.8"
      }
    ]
  }
]