CyberRota Analysis
AI-GeneratedBigBlueButton versions prior to 3.0.29 are vulnerable to a cross-site scripting (XSS) attack due to improper escaping of the meeting name in the playback interface, allowing low-privileged users to inject malicious scripts. This could lead to unauthorized script execution in the browsers of users replaying the recordings, potentially compromising user data or session integrity. Organizations using affected versions should prioritize updating to 3.0.29 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton failed to escape meetingName in record-and-playback/screenshare/playback/index.html.erb when generating the screenshare playback format. A low-privileged user could store a crafted meeting name that embedded script content, and the script executed in another user's browser when that user replayed the recording. This issue is fixed in version 3.0.29.