BigBlueButton Stored Cross-Site Scripting Vulnerability in Shared Notes Feature

A stored cross-site scripting vulnerability has been identified in BigBlueButton versions prior to 3.0.13, specifically within the 'Shared Notes' feature. The issue arises when a user with a malicious username inputs data that is not properly sanitized. This malicious script is then executed on the 'Shared Notes' page, but only when viewed by users with higher privileges, such as Admins. As a result, low-privileged users can execute arbitrary JavaScript in the context of these higher-privileged users.

Impact

Exploitation of this vulnerability allows low-privileged users to execute arbitrary JavaScript in the context of higher-privileged users, such as Admins, who access the Shared Notes page. This could lead to various malicious actions, such as session hijacking, installing keyloggers, or redirecting users to malicious websites.

Remediation

Users are advised to upgrade to BigBlueButton version 3.0.13 or later, where this vulnerability has been patched.