{"vulnerability": "cve-2022-31064", "sightings": [{"uuid": "4bd716e4-da96-42a5-a08b-79e9c5c167ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31064", "type": "seen", "source": "https://t.me/cibsecurity/45235", "content": "\u203c CVE-2022-31064 \u203c\n\nBigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-06-28T00:35:11.000000Z"}, {"uuid": "72a7448b-1153-4f0d-a85b-29d1fe795c2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31064", "type": "seen", "source": "https://t.me/hacking_Attack/59731", "content": "Exploit Collector\nBigBlueButton 2.3 / 2.4.7 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png \nBigBlueButton versions 2.3, prior to 2.4.8, and prior to 2.5.0 suffer from a persistent cross site scripting vulnerability.\n\nSHA-256 | c68ede95337b08934eceb60e7e3ded22f6717375681d84eac96231f4c47ee8b1\n\nDownload\nCVE-2022-31064 - Stored Cross-Site Scripting in BigBlueButton.\n\n=========================\n\nExploit Title: Stored Cross-Site Scripting (XSS) in BigBlueButton\n\nProduct: BigBlueButton\n\nVendor: BigBlueButton\n\nVulnerable Versions: 2.3, <2.4.8,\n\nTested Version: 2.4.7\n\nAdvisory Publication: Jun 22, 2022\n\nLatest Update: Jun 22, 2022\n\nVulnerability Type: Cross-Site Scripting [CWE-79]\n\nCVE Reference: CVE-2022-31064\n\nCVSS Severity: High\n\nCVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\nImpact score: 7.2\n\nCredit: Rick Verdoes & Danny de Weille (Hackify | pentests.nl)\n=========================\nI. BACKGROUND\n\n-------------------------\nBigBlueButton is an open source web conferencing system designed for online meetings and online learning. BigBlueButton is a tool used by instructors and teachers, which helps them access to Learning Management Systems, engagement tools and analytics.\n\nII. VULNERABILITY\n-------------------------\nUsers in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with a XSS payload in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.\n\nIII. Proof of Concept\n-------------------------\n \n\nIV. References\n-------------------------\nSecurity advisory https://pentests.nl/pentest-blog/stored-xss-in-bigbluebutton/\nPatched on BigBlueButton 2.5 (https://github.com/bigbluebutton/bigbluebutton/pull/15067)\nPatched on BigBlueButton 2.4 (https://github.com/bigbluebutton/bigbluebutton/pull/15090)\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:35.355482Z"}, {"uuid": "84e2d3a1-908d-463a-aad8-1cb93ff11fc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-31064", "type": "seen", "source": "https://t.me/hacking_Attack/59731", "content": "Exploit Collector\nBigBlueButton 2.3 / 2.4.7 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png \nBigBlueButton versions 2.3, prior to 2.4.8, and prior to 2.5.0 suffer from a persistent cross site scripting vulnerability.\n\nSHA-256 | c68ede95337b08934eceb60e7e3ded22f6717375681d84eac96231f4c47ee8b1\n\nDownload\nCVE-2022-31064 - Stored Cross-Site Scripting in BigBlueButton.\n\n=========================\n\nExploit Title: Stored Cross-Site Scripting (XSS) in BigBlueButton\n\nProduct: BigBlueButton\n\nVendor: BigBlueButton\n\nVulnerable Versions: 2.3, <2.4.8,\n\nTested Version: 2.4.7\n\nAdvisory Publication: Jun 22, 2022\n\nLatest Update: Jun 22, 2022\n\nVulnerability Type: Cross-Site Scripting [CWE-79]\n\nCVE Reference: CVE-2022-31064\n\nCVSS Severity: High\n\nCVSS Score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N\nImpact score: 7.2\n\nCredit: Rick Verdoes & Danny de Weille (Hackify | pentests.nl)\n=========================\nI. BACKGROUND\n\n-------------------------\nBigBlueButton is an open source web conferencing system designed for online meetings and online learning. BigBlueButton is a tool used by instructors and teachers, which helps them access to Learning Management Systems, engagement tools and analytics.\n\nII. VULNERABILITY\n-------------------------\nUsers in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with a XSS payload in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.\n\nIII. Proof of Concept\n-------------------------\n \n\nIV. References\n-------------------------\nSecurity advisory https://pentests.nl/pentest-blog/stored-xss-in-bigbluebutton/\nPatched on BigBlueButton 2.5 (https://github.com/bigbluebutton/bigbluebutton/pull/15067)\nPatched on BigBlueButton 2.4 (https://github.com/bigbluebutton/bigbluebutton/pull/15090)\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:45.150494Z"}]}