Summary
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in BigBlueButton ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen und Daten zu manipulieren.
Product
BigBlueButton ist ein Open-Source-Web-Konferenzsystem.
Vulnerabilities 2
-
Medium 5.4
BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a craf…
-
Medium 4.9
BigBlueButton: IDOR on BBB through /api/graphql via POST parameter "presentationId" leads to Authentication Bypass
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified a presentation belonging to another meeting. akka-bbb-apps/src/main/scala/org/bigbluebutton/core/ap…
Revision history
-
#2
CVE-Nummern ergänzt
-
#1
Initiale Fassung
References
-
GitHub Security Advisory GHSA-57p5-c888-74f9 vom 2026-06-14
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-57p5-c888-74f9
-
GitHub Security Advisory GHSA-jxpq-r3h3-p75g vom 2026-06-14
https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-jxpq-r3h3-p75g