CVE-2025-55200: BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes
BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the "Shared Notes" feature contains a Stored Cross-Site Scripting (XSS) vulnerability with the input location being the "Username" field and the output location on the "Shared Notes" page, when a user with a malicious username is editing content. This vulnerability allows a low-privileged user to execute arbitrary JavaScript in the context of higher-privileged users (e.g., Admins) who open the Shared Notes page. Version 3.0.13 fixes the issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55200?
CVE-2025-55200 has been rated as a moderate severity stored Cross-Site Scripting vulnerability.
How do I fix CVE-2025-55200?
To fix CVE-2025-55200, upgrade BigBlueButton to version 3.0.13 or later.
What is affected by CVE-2025-55200?
CVE-2025-55200 affects BigBlueButton versions prior to 3.0.13, specifically the "Shared Notes" feature.
What happens if I am vulnerable to CVE-2025-55200?
If vulnerable to CVE-2025-55200, attackers could exploit the XSS vulnerability via the "Username" field to execute malicious scripts.
Is CVE-2025-55200 publicly known?
Yes, CVE-2025-55200 is a publicly disclosed vulnerability affecting BigBlueButton.