title: Cross site scripting vulnerability for private chat in bigbluebutton
description: BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker (whose username contains malicious JavaScript), the script gets executed. Additionally when the victim receives a notification that the attacker has left the session. This issue has been patched in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.
problem types: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
affected:
{
product: bigbluebutton
vendor: bigbluebutton
versions:
status: affected, version: < 2.4.8
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
]