Medium severity · published Jun 2, 2022
CVE-2022-26497
BigBlueButton Greenlight 2.11.1 allows XSS
5.4
CVSS
0.9%
EPSS
No
On KEV
Description
BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Greenlight · Bigbluebutton
2.11.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-26497
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-26497
packetstormsecurity.com
http://packetstormsecurity.com/files/172143/Shannon-Baseband-acfg-pcfg-SDP-Attribute-Memory-Corruption.html
Exploit
https://github.com/bigbluebutton/greenlight/blob/master/app/assets/javascripts/room.js#L352
Patch
https://www.mgm-sp.com/en/cve-2022-26497-bigbluebutton-greenlight-xss/
More from Greenlight
8.8
CVE-2020-26163
BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link
6.1
CVE-2022-36029
BigBlueButton Greenlight Open Redirect vulnerability
6.1
CVE-2022-36028
BigBlueButton Greenlight Open Redirect vulnerability
6.1
CVE-2020-27642
A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6
5.3
CVE-2022-31039
Greenlight is a simple front-end interface for your BigBlueButton server