CVE-2022-31065

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in their username and have it executed on the victim's client. When a user receives a private chat from the attacker (whose username contains malicious JavaScript), the script gets executed. Additionally when the victim receives a notification that the attacker has left the session. This issue has been patched in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
bigbluebuttonbigbluebutton< 2.4.8

References

Timeline

Published
Jun 27, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-310664.4EdgeX Foundry is an open source project for building a common open framework for Internet of Things edge computing. Prior to version 2.1.1, CVE-2022-310685.3GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2022-310697.5NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to control CVE-2022-31075.5An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of theCVE-2022-310707.5NestJS Proxy is a NestJS module to decorate and proxy calls. Prior to version 0.7.0, the nestjs-proxy library did not have a way to block seCVE-2022-310713.3Octopoller is a micro gem for polling and retrying. Version 0.2.0 of the octopoller gem was published containing world-writeable files. SpecCVE-2022-310723.3Octokit is a Ruby toolkit for the GitHub API. Versions 4.23.0 and 4.24.0 of the octokit gem were published containing world-writeable files.CVE-2022-310737.5KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versiCVE-2022-310746.5KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versiCVE-2022-310756.5KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versiCVE-2022-310765.7KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In CVE-2022-310775.7KubeEdge is built upon Kubernetes and extends native containerized application orchestration and device management to hosts at the Edge. In