BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NBigbluebutton Greenlight
APPBigbluebutton2.11.1
Powiązane podatności
Open redirect w Greenlight (BigBlueButton) — podatność w stronie logowania
Open redirect w Greenlight (BigBlueButton) — niezweryfikowana wartość cookie return_to
BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Accoun...
Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can...
A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlue...