A stored cross-site scripting vulnerability in BigBlueButton versions prior to 3.0.13 allows low-privileged users to execute malicious scripts in the context of higher-privileged administrative sessions.

The application fails to properly sanitize the Username field, which is subsequently rendered within the Shared Notes page. This allows an authenticated low-privileged user to inject malicious JavaScript that executes when an administrator views the Shared Notes content.

The exploitation of this vulnerability could lead to unauthorized administrative actions, session hijacking, or the theft of sensitive session tokens. Given the CVSS score of 7.1, this flaw poses a significant risk to the integrity and confidentiality of virtual classroom environments where administrative control is critical.

Immediate Action: Upgrade BigBlueButton to version 3.0.13 or later to apply the necessary input sanitization patches.

Proactive Monitoring: Review access logs for suspicious username strings containing script tags or abnormal activity within the Shared Notes feature.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of unauthorized scripts and utilize a Web Application Firewall (WAF) to filter malicious input patterns in user-submitted fields.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk to administrative security within the BigBlueButton platform. Administrators should prioritize the deployment of version 3.0.13 immediately to neutralize the risk of stored cross-site scripting attacks. Failure to patch may allow malicious actors to escalate privileges within the platform, potentially compromising the entire virtual classroom session.