CVE-2022-27238 - CVE House
Back to Database
Status published Medium CVE-2022-27238

BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site...

Vulnerability Description

BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to the victim or when notification about the attacker leaving room is displayed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-27238

Credits & Attribution

No credits recorded in the NVD database.

References

More from bigbluebutton

View All →
CVE-2025-61602
BigBlueButton vulnerable to Chat DoS via invalid reactionEmojiId
High 7.5
CVE-2025-61601
BigBlueButton vulnerable to DoS via PollSubmitVote GraphQL mutation
High 7.5
CVE-2025-55200
BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes
High 7.1
CVE-2024-39302
Some bbb-record-core files installed with wrong file permission
Low 3.7
CVE-2024-38518
bbb-web API additional parameters considered
Medium 4.6

Affected Vendor

bigbluebutton

View all reports →

Affected Software

bigbluebutton
Vulnerable Versions:
0

Timeline

Official Publish: June 24th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.