CVE-2022-31064: Cross site scripting in username that will trigger by sending chat
BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-31064?
CVE-2022-31064 is a vulnerability in the BigBlueButton web conferencing system that allows for cross-site scripting attacks in meetings with private chat enabled.
What is the severity of CVE-2022-31064?
The severity of CVE-2022-31064 is medium, with a CVSS score of 5.4.
Which versions of BigBlueButton are affected by CVE-2022-31064?
Versions 2.3.0 to 2.4.8 of BigBlueButton are affected by CVE-2022-31064.
How does CVE-2022-31064 work?
CVE-2022-31064 occurs when the attacker (with xss in the name) starts a chat in the victim's client, executing JavaScript.
Are there any patches or fixes available for CVE-2022-31064?
Yes, the BigBlueButton project has released a fix for CVE-2022-31064, which can be found in their GitHub repository.