CVE-2022-26497

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-26497

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26497.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-26497

Published

2022-06-02T00:00:00Z

Modified

2026-07-15T01:49:00.266175611Z

Summary

[none]

Details

BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously.

Database specific

{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/26xxx/CVE-2022-26497.json"
}

References

Affected packages

Git / github.com/bigbluebutton/greenlight

Affected ranges

Type

GIT

Repo

https://github.com/bigbluebutton/greenlight

Events

Introduced

37a66dcc1ef3750f45ddd2427b714ffd69d3fd1b

Last affected

37a66dcc1ef3750f45ddd2427b714ffd69d3fd1b

Database specific

{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:bigbluebutton:greenlight:2.11.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.11.1"
        },
        {
            "last_affected": "2.11.1"
        }
    ]
}

Affected versions

2.*

2.11.1

release-2.*

release-2.11.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-26497.json"