web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name.
cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*
5FA0DCDA-3F90-4D22-A5A1-E6CD7861C2B8
2.2.29
OR
The join API is not filtering for control characters in user name.
This can be a problem for some XML parsers.
Join API should filter control characters from user's name
This is a GitHub Issue
repo:bigbluebutton
owner:bigbluebutton
Title : Join API should filter control characters from user's name
Issue date:

--- start body ---
The join API is not filtering for control characters in user name.
This can be a problem for some XML parsers.
--- end body ---

comments :
--- start comments ---

--- end comments ---