Lucene search

GoogleOSV:CVE-2023-43797

HistoryOct 30, 2023 - 11:15 p.m.

CVE-2023-43797

2023-10-3023:15:08

Google

osv.dev

bigbluebutton

guest lobby

xss vulnerability

text sanitizing

open source

virtual classroom

software security

CVSS3

6.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

24.5%

JSON

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.

References

github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d

github.com/bigbluebutton/bigbluebutton/pull/18392

github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73x