Cross-Site Scripting Vulnerability in BigBlueButton Greenlight by BigBlueButton
CVE-2022-26497

5.4MEDIUM

Key Information:

Vendor

Bigbluebutton

Status
Greenlight
Vendor
CVE Published:
2 June 2022

What is CVE-2022-26497?

BigBlueButton Greenlight version 2.11.1 has a vulnerability that allows a Cross-Site Scripting (XSS) attack. An attacker can exploit this vulnerability by using a username that contains a malicious JavaScript payload. If a user has previously shared access to a room with the attacker, this payload can execute in the victim's browser within the 'Share room access' dialog, potentially compromising sensitive data and session integrity.

References

https://github.com/bigbluebutton/greenlight/blob/master/a...
https://www.mgm-sp.com/en/cve-2022-26497-bigbluebutton-gr...
http://packetstormsecurity.com/files/172143/Shannon-Baseb...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.