CVE-2023-43797

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby messages starting in versions 2.6.11 and 2.7.0-beta.3. There are no known workarounds.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
bigbluebutton	bigbluebutton	< 2.6.11; >= 2.7.0-alpha.1, < 2.7.0-beta.3

References

https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9dPatch, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/18392Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73xThird Party Advisory
https://github.com/bigbluebutton/bigbluebutton/commit/304bc851a00558f99a908880f4ac44234a074c9dPatch, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/pull/18392Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6wg-q866-h73xThird Party Advisory

Timeline

Published: Oct 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-437985.4BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Reques CVE-2023-437997.8Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before pas CVE-2023-43806.3A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in pla CVE-2023-438007.8Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A u CVE-2023-438017.1Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and CVE-2023-438027.8Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles reques CVE-2023-438037.1Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and CVE-2023-438048.1urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the `Cookie` HTTP header special or provide any helpers for CVE-2023-438057.5Nexkey is a fork of Misskey, an open source, decentralized social media platform. Prior to version 12.121.9, incomplete URL validation can a CVE-2023-438097.5Soft Serve is a self-hostable Git server for the command line. Prior to version 0.6.2, a security vulnerability in Soft Serve could allow an CVE-2023-43814.3Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.CVE-2023-438107.5OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecti