PT-2023-28989 · Unknown · Bigbluebutton

Devme4Ff · Published 2023-10-30 · Updated 2023-11-07 · CVE-2023-43797

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.6.11 BigBlueButton versions prior to 2.7.0-beta.3

Description The issue affects BigBlueButton, an open-source virtual classroom, where the Guest Lobby is vulnerable to cross-site scripting. This occurs when users wait to enter a meeting due to the insertion of unsanitized messages into an element using unsafe innerHTML. The vulnerability is addressed by adding text sanitizing for lobby messages.

Recommendations For BigBlueButton versions prior to 2.6.11, update to version 2.6.11 or later to resolve the issue. For BigBlueButton versions prior to 2.7.0-beta.3, update to version 2.7.0-beta.3 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-43797

GHSA-V6WG-Q866-H73X

Affected Products

Bigbluebutton

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43797.json · Exploit
• https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d · Patch
• https://osv.dev/vulnerability/CVE-2023-43797 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43797 · Security Note
• https://github.com/bigbluebutton/bigbluebutton/pull/18392 · Note
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73x · Note
• https://t.me/cibsecurity/73193 · Telegram Post