CVE-2022-31064 MEDIUM

CVE-2022-31064: Cross site scripting in username that will trigger by sending chat

Vendor Bigbluebutton
Product bigbluebutton
Weakness CWE-79 · XSS
Published June 27, 2022
Last update April 22, 2025
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

June 27, 2022 CVE published
April 22, 2025 Record updated