We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2023-43797

BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby



Description

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.

Reserved 2023-09-22 | Published 2023-10-30 | Updated 2024-09-05 | Assigner GitHub_M


MEDIUM: 6.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

< 2.6.11
affected

>= 2.7.0-alpha.1, < 2.7.0-beta.3
affected

References

github.com/...button/security/advisories/GHSA-v6wg-q866-h73x

github.com/bigbluebutton/bigbluebutton/pull/18392

github.com/...ommit/304bc851a00558f99a908880f4ac44234a074c9d

cve.org (CVE-2023-43797)

nvd.nist.gov (CVE-2023-43797)

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2023-43797

Support options

Helpdesk Chat, Email, Knowledgebase
Subscribe to our newsletter to learn more about our work.