Vulnerability Details : CVE-2022-31064

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.

Vulnerability category: Cross site scripting (XSS)

Published 2022-06-27 20:15:09

Updated 2022-07-07 19:07:28

Source GitHub, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-31064

Probability of exploitation activity in the next 30 days: 0.18%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 55 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2022-31064

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
2.1	LOW	AV:N/AC:H/Au:S/C:N/I:P/A:N	3.9	2.9	[email protected]
Access Vector: Network Access Complexity: High Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	2.3	2.7	[email protected]
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L	2.3	3.7	[email protected]
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: Low

CWE ids for CVE-2022-31064

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: [email protected] (Primary)

References for CVE-2022-31064

https://github.com/bigbluebutton/bigbluebutton/pull/15090

Patch;Third Party Advisory

CVEs referencing this url
https://github.com/bigbluebutton/bigbluebutton/pull/15067

Patch;Release Notes;Third Party Advisory
http://seclists.org/fulldisclosure/2022/Jun/52

Exploit;Mailing List;Third Party Advisory
https://pentests.nl/pentest-blog/stored-xss-in-bigbluebutton/

Exploit;Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-hwv2-5pf5-hr87

Patch;Third Party Advisory
http://packetstormsecurity.com/files/167682/BigBlueButton-2.3-2.4.7-Cross-Site-Scripting.html

Exploit;Third Party Advisory;VDB Entry

Products affected by CVE-2022-31064

Bigbluebutton » Bigbluebutton
Versions from including (>=) 2.4 and before (<) 2.4.8
cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Alpha1
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha1:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Beta1
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:beta1:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Alpha6
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha6:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Alpha5
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha5:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Alpha4
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha4:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Alpha3
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha3:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Alpha2
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha2:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Beta2
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:beta2:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.3.0
cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.0:*:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.4.9
cpe:2.3:a:bigbluebutton:bigbluebutton:2.4.9:*:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Rc.1
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.1:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Rc.2
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.2:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Rc.3
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.3:*:*:*:*:*:*
Matching versions
Bigbluebutton » Bigbluebutton » Version: 2.5 Update Rc.4
cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.4:*:*:*:*:*:*
Matching versions