CVE-2022-26497: XSS
BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-26497?
CVE-2022-26497 is a vulnerability in BigBlueButton Greenlight 2.11.1 that allows XSS (Cross-Site Scripting).
How does CVE-2022-26497 work?
CVE-2022-26497 allows a threat actor to have a username containing a JavaScript payload, which gets executed in the browser of the victim in the 'Share room access' dialog if the victim has shared access to the particular room with the attacker previously.
What is the severity of CVE-2022-26497?
CVE-2022-26497 has a severity rating of medium with a CVSS score of 5.4.
How can I fix CVE-2022-26497?
To fix CVE-2022-26497, it is recommended to upgrade to a patched version of BigBlueButton Greenlight beyond 2.11.1.
Is there any further information about CVE-2022-26497?
Yes, you can find more information about CVE-2022-26497 at the following references: http://packetstormsecurity.com/files/172143/Shannon-Baseband-acfg-pcfg-SDP-Attribute-Memory-Corruption.html, https://github.com/bigbluebutton/greenlight/blob/master/app/assets/javascripts/room.js#L352, https://www.mgm-sp.com/en/cve-2022-26497-bigbluebutton-greenlight-xss/