CVE-2025-55200

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-55200", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-08-08T21:55:07.965Z", "datePublished": "2025-10-09T18:51:57.884Z", "dateUpdated": "2025-10-09T19:08:17.415Z"}, "containers": {"cna": {"title": "BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9jv9-cjrm-grj2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9jv9-cjrm-grj2"}, {"name": "https://github.com/bigbluebutton/bbb-pads/pull/67", "tags": ["x_refsource_MISC"], "url": "https://github.com/bigbluebutton/bbb-pads/pull/67"}, {"name": "https://github.com/bigbluebutton/bigbluebutton/pull/23693", "tags": ["x_refsource_MISC"], "url": "https://github.com/bigbluebutton/bigbluebutton/pull/23693"}, {"name": "https://github.com/bigbluebutton/bbb-pads/releases/tag/v1.5.4", "tags": ["x_refsource_MISC"], "url": "https://github.com/bigbluebutton/bbb-pads/releases/tag/v1.5.4"}], "affected": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"version": "< 3.0.13", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-09T18:51:57.884Z"}, "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the \"Shared Notes\" feature contains a Stored Cross-Site Scripting (XSS) vulnerability with the input location being the \"Username\" field and the output location on the \"Shared Notes\" page, when a user with a malicious username is editing content. This vulnerability allows a low-privileged user to execute arbitrary JavaScript in the context of higher-privileged users (e.g., Admins) who open the Shared Notes page. Version 3.0.13 fixes the issue."}], "source": {"advisory": "GHSA-9jv9-cjrm-grj2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-09T19:08:12.867816Z", "id": "CVE-2025-55200", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T19:08:17.415Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-55200", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-09T19:08:12.867816Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-09T19:08:14.974Z"}}], "cna": {"title": "BigBlueButton vulnerable to Stored XSS via name of user at Shared Notes", "source": {"advisory": "GHSA-9jv9-cjrm-grj2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "bigbluebutton", "product": "bigbluebutton", "versions": [{"status": "affected", "version": "< 3.0.13"}]}], "references": [{"url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9jv9-cjrm-grj2", "name": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9jv9-cjrm-grj2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/bigbluebutton/bbb-pads/pull/67", "name": "https://github.com/bigbluebutton/bbb-pads/pull/67", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/bigbluebutton/bigbluebutton/pull/23693", "name": "https://github.com/bigbluebutton/bigbluebutton/pull/23693", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/bigbluebutton/bbb-pads/releases/tag/v1.5.4", "name": "https://github.com/bigbluebutton/bbb-pads/releases/tag/v1.5.4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the \"Shared Notes\" feature contains a Stored Cross-Site Scripting (XSS) vulnerability with the input location being the \"Username\" field and the output location on the \"Shared Notes\" page, when a user with a malicious username is editing content. This vulnerability allows a low-privileged user to execute arbitrary JavaScript in the context of higher-privileged users (e.g., Admins) who open the Shared Notes page. Version 3.0.13 fixes the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-09T18:51:57.884Z"}}}, "cveMetadata": {"cveId": "CVE-2025-55200", "state": "PUBLISHED", "dateUpdated": "2025-10-09T19:08:17.415Z", "dateReserved": "2025-08-08T21:55:07.965Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-09T18:51:57.884Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "bigbluebutton", "vendor": "bigbluebutton", "versions": [{"status": "affected", "version": "< 3.0.13"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*", "matchCriteriaId": "0AF3725E-941E-4C75-AA27-20DC97552948", "versionEndExcluding": "3.0.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.13, the \"Shared Notes\" feature contains a Stored Cross-Site Scripting (XSS) vulnerability with the input location being the \"Username\" field and the output location on the \"Shared Notes\" page, when a user with a malicious username is editing content. This vulnerability allows a low-privileged user to execute arbitrary JavaScript in the context of higher-privileged users (e.g., Admins) who open the Shared Notes page. Version 3.0.13 fixes the issue."}, {"lang": "es", "value": "BigBlueButton es un aula virtual de c\u00f3digo abierto. En versiones anteriores a la 3.0.13, la funci\u00f3n 'Notas Compartidas' contiene una vulnerabilidad de cross-site scripting (XSS) almacenado, con la ubicaci\u00f3n de entrada siendo el campo 'Nombre de usuario' y la ubicaci\u00f3n de salida en la p\u00e1gina 'Notas Compartidas', cuando un usuario con un nombre de usuario malicioso est\u00e1 editando contenido. Esta vulnerabilidad permite a un usuario con privilegios bajos ejecutar JavaScript arbitrario en el contexto de usuarios con privilegios m\u00e1s altos (p. ej., administradores) que abren la p\u00e1gina de Notas Compartidas. La versi\u00f3n 3.0.13 corrige el problema."}], "id": "CVE-2025-55200", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55200", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-09T19:08:12.867816Z", "version": "2.0.3"}}]}, "published": "2025-10-09T19:15:43.663", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Product"], "url": "https://github.com/bigbluebutton/bbb-pads/pull/67"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/bigbluebutton/bbb-pads/releases/tag/v1.5.4"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/bigbluebutton/bigbluebutton/pull/23693"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-9jv9-cjrm-grj2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-10T11:17:33.588964+00:00", "updated": "2025-10-10T11:17:33.588989+00:00", "vendors": ["bigbluebutton", "bigbluebutton$PRODUCT$bigbluebutton"]}