CVE-2022-31065

BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker (whose username contains malicious JavaScript), the script gets executed. Additionally when the victim receives a notification that the attacker has left the session. This issue has been patched in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.

Link	Resource
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8m2p-7qv3-qff7	Patch Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/15087	Patch Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/15090	Patch Third Party Advisory

Configuration 1

cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha1:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:beta2:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:beta1:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha6:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha5:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha4:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha3:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha2:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.0:*:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.3:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.4:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.2:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.1:*:*:*:*:*:* cpe:2.3:a:bigbluebutton:bigbluebutton:2.4.9:*:*:*:*:*:*:*

---

Published : 2022-06-27 08:15

Updated : 2022-07-07 07:17

---

NVD link : CVE-2022-31065

Mitre link : CVE-2022-31065

No products.

CWE-79