CVE-2023-43797: BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-43797?
CVE-2023-43797 is a stored cross-site scripting vulnerability in the Guest Lobby feature of BigBlueButton, an open-source virtual classroom software.
What is the severity of CVE-2023-43797?
The severity of CVE-2023-43797 is medium with a CVSS score of 6.3.
How does CVE-2023-43797 affect BigBlueButton?
CVE-2023-43797 affects BigBlueButton versions 2.6.11 and 2.7.0-alpha1, 2.7.0-alpha2, 2.7.0-alpha3, 2.7.0-beta1, and 2.7.0-beta2. Prior to these versions, the Guest Lobby feature was vulnerable to stored cross-site scripting.
How can the stored cross-site scripting vulnerability in the Guest Lobby of BigBlueButton be fixed?
To fix the stored cross-site scripting vulnerability in the Guest Lobby of BigBlueButton, update to version 2.6.11 or version 2.7.0-beta.3 or later.
Where can I find more information about CVE-2023-43797?
More information about CVE-2023-43797 can be found in the BigBlueButton security advisory (GHSA-v6wg-q866-h73x) on GitHub.