CVE-2022-31064

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.

• CWE-79

• http://packetstormsecurity.com/files/167682/BigBlueButton-2.3-2.4.7-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jun/52Exploit, Mailing List, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/pull/15067Patch, Release Notes, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/pull/15090Patch, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-hwv2-5pf5-hr87Patch, Third Party Advisory
• https://pentests.nl/pentest-blog/stored-xss-in-bigbluebutton/Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/167682/BigBlueButton-2.3-2.4.7-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/Jun/52Exploit, Mailing List, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/pull/15067Patch, Release Notes, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/pull/15090Patch, Third Party Advisory
• https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-hwv2-5pf5-hr87Patch, Third Party Advisory
• https://pentests.nl/pentest-blog/stored-xss-in-bigbluebutton/Exploit, Third Party Advisory

Published

Jun 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31059Discourse Calendar is a calendar plugin for Discourse, an op…5.4
• CVE-2022-3106An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31060Discourse is an open-source discussion platform. Prior to ve…5.3
• CVE-2022-31061GLPI is a Free Asset and IT Management Software package, Dat…9.8
• CVE-2022-31062### Impact A plugin public script can be used to read conten…5.3
• CVE-2022-31063Tuleap is a Free & Open Source Suite to improve management o…5.4
• CVE-2022-31065BigBlueButton is an open source web conferencing system. In …6.1
• CVE-2022-31066EdgeX Foundry is an open source project for building a commo…4.4
• CVE-2022-31068GLPI is a Free Asset and IT Management Software package, Dat…5.3
• CVE-2022-31069NestJS Proxy is a NestJS module to decorate and proxy calls.…7.5
• CVE-2022-3107An issue was discovered in the Linux kernel through 5.16-rc6…5.5
• CVE-2022-31070NestJS Proxy is a NestJS module to decorate and proxy calls.…7.5