PT-2023-28989 · Unknown · Bigbluebutton

Devme4Ff · Publicado 2023-10-30 · Atualizado 2023-11-07 · CVE-2023-43797

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.6.11 BigBlueButton versions prior to 2.7.0-beta.3

Description The issue affects BigBlueButton, an open-source virtual classroom, where the Guest Lobby is vulnerable to cross-site scripting. This occurs when users wait to enter a meeting due to the insertion of unsanitized messages into an element using unsafe innerHTML. The vulnerability is addressed by adding text sanitizing for lobby messages.

Recommendations For BigBlueButton versions prior to 2.6.11, update to version 2.6.11 or later to resolve the issue. For BigBlueButton versions prior to 2.7.0-beta.3, update to version 2.7.0-beta.3 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-43797

GHSA-V6WG-Q866-H73X

Produtos afetados

Bigbluebutton

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43797.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d · Correção
• https://github.com/bigbluebutton/bigbluebutton/pull/18392 · Nota
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73x · Nota
• https://osv.dev/vulnerability/CVE-2023-43797 · Aviso do Fabricante
• https://t.me/cibsecurity/73193 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-43797 · Nota de Segurança