« Volver al listado

CVE-2026-27737

Estado: AplazadaMedia (6.5)—

BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Bigbluebutton — BigbluebuttonAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-27737",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-27737",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-19T12:11:45.789071Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "bigbluebutton",
          "product": "bigbluebutton",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.0.19"
            }
          ]
        },
        {
          "vendor": "blindsidenetworks",
          "product": "scalite",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.7.0"
            }
          ]
        },
        {
          "vendor": "bigbluebutton",
          "product": "bbb-playback",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.4.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-18T22:16:37.523",
  "references": [
    {
      "url": "https://github.com/bigbluebutton/bbb-playback/commit/09e89bfe4ff8488b68c3ff040d3081e419dc89b1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/commit/69f45aa1b963dc7d80179d0155acc670aec5c4fc",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/releases/tag/v3.0.19",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-8vv7-vj94-q2pv",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/blindsidenetworks/scalelite/releases/tag/v1.7.0",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "BigBlueButton is an open-source virtual classroom. In versions prior to 3.0.19, the recording playback (presentation format) was not sanitizing user's input in public chat. This allowed for a malicious actor to craft and carry out a targeted XSS attack, activated on anyone replaying the recording. This issue has been fixed 3.0.19."
    },
    {
      "lang": "es",
      "value": "BigBlueButton es un aula virtual de código abierto. En versiones anteriores a la 3.0.19, la reproducción de grabaciones (formato de presentación) no estaba saneando la entrada del usuario en el chat público. Esto permitía a un actor malicioso diseñar y ejecutar un ataque XSS dirigido, que se activaba en cualquiera que reprodujera la grabación. Este problema se ha solucionado en la versión 3.0.19."
    }
  ],
  "lastModified": "2026-07-24T13:10:00.223",
  "sourceIdentifier": "security-advisories@github.com"
}