CVE-2020-27604

🗓️ 21 Oct 2020 14:09:11Reported by mitreType

cve🔗 web.nvd.nist.gov👁 44 Views🌐 WEB

BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With the API shared secret, an attacker can (for example) use api/join to join an arbitrary meeting regardless of its guestPolicy setting

Reporter	Title	Published	Views	Family All 5
Cvelist	CVE-2020-27604	21 Oct 202014:09	–	cvelist
EUVD	EUVD-2020-20111	7 Oct 202500:30	–	euvd
NVD	CVE-2020-27604	21 Oct 202015:15	–	nvd
Prion	Design/Logic Flaw	21 Oct 202015:15	–	prion
RedhatCVE	CVE-2020-27604	22 May 202515:27	–	redhatcve

NVD

Node

bigbluebutton bigbluebuttonRange<2.2.8

Source	Link
golem	www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.html
docs	www.docs.bigbluebutton.org/dev/api.html

Parameter	Position	Path	Description	CWE
meetingID	query param	api/join	Remote attacker can join meeting using API join despite guestPolicy by abusing API access and reading shared secret due to insufficient sandboxing in BigBlueButton prior to 2.3.	CWE-116
fullName	query param	api/join	Remote attacker can join meeting using API join despite guestPolicy by abusing API access and reading shared secret due to insufficient sandboxing in BigBlueButton prior to 2.3.	CWE-116
password	query param	api/join	Remote attacker can join meeting using API join despite guestPolicy by abusing API access and reading shared secret due to insufficient sandboxing in BigBlueButton prior to 2.3.	CWE-116
checksum	query param	api/join	Remote attacker can join meeting using API join despite guestPolicy by abusing API access and reading shared secret due to insufficient sandboxing in BigBlueButton prior to 2.3.	CWE-116

17 Jun 2026 03:09Current

6.1Medium risk

Vulners AI Score6.1

CVSS 24

CVSS 3.16.5

EPSS0.01147

CWE-116