CVE-2022-31064: Bigbluebutton

Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days.

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a cross site scripting attack in affected versions. The attack occurs when the attacker (with xss in the name) starts a chat. in the victim's client the JavaScript will be executed. This issue has been addressed in version 2.4.8 and 2.5.0. There are no known workarounds for this issue.

Affected products

• Bigbluebutton Bigbluebutton: from 2.4, before 2.4.8 (fixed in 2.4.8); version 2.3.0 only; version 2.4.9 only; version 2.5 only

Published 2022-06-27. Last modified 2026-06-17.