CVE-2023-43797

Description

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.

Reserved 2023-09-22 | Published 2023-10-30 | Updated 2024-09-05 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

< 2.6.11
affected

>= 2.7.0-alpha.1, < 2.7.0-beta.3
affected

References

github.com/...button/security/advisories/GHSA-v6wg-q866-h73x

github.com/bigbluebutton/bigbluebutton/pull/18392

github.com/...ommit/304bc851a00558f99a908880f4ac44234a074c9d

cve.org (CVE-2023-43797)

nvd.nist.gov (CVE-2023-43797)

Download JSON