CVE-2023-43797: BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
First published: Mon Oct 30 2023(Updated: )
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bigbluebutton Bigbluebutton | <2.6.11 | |
| Bigbluebutton Bigbluebutton | =2.7.0-alpha1 | |
| Bigbluebutton Bigbluebutton | =2.7.0-alpha2 | |
| Bigbluebutton Bigbluebutton | =2.7.0-alpha3 | |
| Bigbluebutton Bigbluebutton | =2.7.0-beta1 | |
| Bigbluebutton Bigbluebutton | =2.7.0-beta2 |
Remedy
https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9d
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-43797?
CVE-2023-43797 is a stored cross-site scripting vulnerability in the Guest Lobby feature of BigBlueButton, an open-source virtual classroom software.
What is the severity of CVE-2023-43797?
The severity of CVE-2023-43797 is medium with a CVSS score of 6.3.
How does CVE-2023-43797 affect BigBlueButton?
CVE-2023-43797 affects BigBlueButton versions 2.6.11 and 2.7.0-alpha1, 2.7.0-alpha2, 2.7.0-alpha3, 2.7.0-beta1, and 2.7.0-beta2. Prior to these versions, the Guest Lobby feature was vulnerable to stored cross-site scripting.
How can the stored cross-site scripting vulnerability in the Guest Lobby of BigBlueButton be fixed?
To fix the stored cross-site scripting vulnerability in the Guest Lobby of BigBlueButton, update to version 2.6.11 or version 2.7.0-beta.3 or later.
Where can I find more information about CVE-2023-43797?
More information about CVE-2023-43797 can be found in the BigBlueButton security advisory (GHSA-v6wg-q866-h73x) on GitHub.
- collector/nvd-api
- agent/references
- agent/type
- agent/weakness
- agent/title
- agent/severity
- agent/author
- agent/tags
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/bigbluebutton
- canonical/bigbluebutton bigbluebutton
- version/bigbluebutton bigbluebutton/2.7.0-alpha1
- version/bigbluebutton bigbluebutton/2.7.0-alpha2
- version/bigbluebutton bigbluebutton/2.7.0-alpha3
- version/bigbluebutton bigbluebutton/2.7.0-beta1
- version/bigbluebutton bigbluebutton/2.7.0-beta2