PT-2022-18320 · Unknown · Bigbluebutton

Published 2022-06-24 · Updated 2022-07-05 · CVE-2022-27238

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions 2.4.7 and earlier

Description The issue concerns stored Cross-Site Scripting (XSS) in the private chat functionality. A threat actor could inject a JavaScript payload in their username. The payload gets executed in the victim's browser each time the attacker sends a private message to the victim or when a notification about the attacker leaving the room is displayed.

Recommendations For BigBlueButton versions 2.4.7 and earlier, consider disabling the private chat functionality until a patch is available to prevent exploitation of the stored XSS vulnerability. Restrict access to the private chat feature to minimize the risk of JavaScript payload injection. Avoid using potentially malicious usernames in the private chat until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-27238

Affected Products

Bigbluebutton

References · 4

• https://osv.dev/vulnerability/CVE-2022-27238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27238 · Security Note
• https://mgm-sp.com/en/cve-2022-27238-bigbluebutton-xss · Note
• https://t.me/cibsecurity/45115 · Telegram Post