Cross site scripting

2022-06-2720:15:00

PRIOn knowledge base

www.prio-n.com

0.002 Low

EPSS

Percentile

59.6%

JSON

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim’s client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.

CPENameOperatorVersion
bigbluebuttoneq2.5 alpha1
bigbluebuttoneq2.5 beta2
bigbluebuttoneq2.5 beta1
bigbluebuttoneq2.5 alpha6
bigbluebuttoneq2.5 alpha5
bigbluebuttoneq2.5 alpha4
bigbluebuttoneq2.5 alpha3
bigbluebuttoneq2.5 alpha2
bigbluebuttonge2.4
bigbluebuttonlt2.4.8

Name	Operator	Version
bigbluebutton	eq	2.5 alpha1
bigbluebutton	eq	2.5 beta2
bigbluebutton	eq	2.5 beta1
bigbluebutton	eq	2.5 alpha6
bigbluebutton	eq	2.5 alpha5
bigbluebutton	eq	2.5 alpha4
bigbluebutton	eq	2.5 alpha3
bigbluebutton	eq	2.5 alpha2
bigbluebutton	ge	2.4
bigbluebutton	lt	2.4.8