MEDIUM🇵🇱 Wersja polska

CVE-2022-26497

CVSS 5.4v3.1pub. 2022-06-02upd. 2024-11-21

BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

  • Bigbluebutton Greenlight

    APP
    Bigbluebutton
    2.11.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2022-36028CRITICAL9.1PL ✓ten sam produkt

Open redirect w Greenlight (BigBlueButton) — podatność w stronie logowania

CVE-2022-36029CRITICAL9.1PL ✓ten sam produkt

Open redirect w Greenlight (BigBlueButton) — niezweryfikowana wartość cookie return_to

CVE-2020-26163HIGH8.8ten sam produkt

BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Accoun...

CVE-2022-31039MEDIUM4.3ten sam produkt

Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can...

CVE-2020-27642MEDIUM6.1ten sam produkt

A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlue...