Medium severity6.5NVD Advisory· Published Jun 27, 2022· Updated Jun 17, 2026
CVE-2022-31064
CVE-2022-31064
Description
BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
17cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 16 more
- cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: >=2.4,<2.4.8
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha1:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha2:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha3:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha4:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha5:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:alpha6:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:beta1:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:beta2:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.1:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.2:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.3:*:*:*:*:*:*
- cpe:2.3:a:bigbluebutton:bigbluebutton:2.5:rc.4:*:*:*:*:*:*
- (no CPE)range: up to 2.4.7, and 2.4.x before 2.4.8, and 2.5.0
- (no CPE)range: < 2.4.8
Patches
Vulnerability mechanics
References
6- github.com/bigbluebutton/bigbluebutton/pull/15067nvdPatchRelease NotesThird Party Advisory
- github.com/bigbluebutton/bigbluebutton/pull/15090nvdPatchThird Party Advisory
- github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-hwv2-5pf5-hr87nvdPatchThird Party Advisory
- packetstormsecurity.com/files/167682/BigBlueButton-2.3-2.4.7-Cross-Site-Scripting.htmlnvdExploitThird Party AdvisoryVDB Entry
- seclists.org/fulldisclosure/2022/Jun/52nvdExploitMailing ListThird Party Advisory
- pentests.nl/pentest-blog/stored-xss-in-bigbluebutton/nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.