CVE-2022-27238

{"id": "CVE-2022-27238", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2022-06-24T16:15:09.243", "references": [{"url": "https://www.mgm-sp.com/en/cve-2022-27238-bigbluebutton-xss/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "BigBlueButton version 2.4.7 (or earlier) is vulnerable to stored Cross-Site Scripting (XSS) in the private chat functionality. A threat actor could inject JavaScript payload in his/her username. The payload gets executed in the browser of the victim each time the attacker sends a private message to the victim or when notification about the attacker leaving room is displayed."}, {"lang": "es", "value": "BigBlueButton versi\u00f3n 2.4.7 (o anterior) es vulnerable a un ataque de tipo Cross-Site Scripting (XSS) almacenado en la funcionalidad private chat. Un actor de la amenaza podr\u00eda inyectar una carga \u00fatil de JavaScript en su nombre de usuario. La carga \u00fatil es ejecutada en el navegador de la v\u00edctima cada vez que el atacante env\u00eda un mensaje privado a la v\u00edctima o cuando se muestra una notificaci\u00f3n sobre la salida del atacante"}], "lastModified": "2022-07-05T21:01:25.607", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AF21C97-CC2D-4DEA-933D-9C0F6EFCAF04", "versionEndIncluding": "2.4.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}