CVE-2022-31065: Cross site scripting vulnerability for private chat in bigbluebutton
BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker (whose username contains malicious JavaScript), the script gets executed. Additionally when the victim receives a notification that the attacker has left the session. This issue has been patched in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-31065?
CVE-2022-31065 is a vulnerability in the BigBlueButton web conferencing system that allows an attacker to execute malicious JavaScript on a victim's client.
What is the severity of CVE-2022-31065?
The severity of CVE-2022-31065 is medium, with a CVSS score of 6.1.
How does CVE-2022-31065 affect BigBlueButton?
In affected versions of BigBlueButton, an attacker can embed malicious JavaScript in their username and have it executed on the victim's client when they receive a private chat.
How can I fix CVE-2022-31065?
To fix CVE-2022-31065, update your BigBlueButton installation to a version that includes the security patches. Refer to the official GitHub repository for more information on the security advisories and patches.
What is CWE-79?
CWE-79 is a common weakness enumeration category for Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).