CVE-2020-27604

2020-10-2114:09:11

mitre

www.cve.org

bigbluebutton

libreoffice sandboxing

remote authenticated users

api shared secret

arbitrary meetings

AI Score

6.2

Confidence

High

EPSS

0.002

Percentile

61.2%

JSON

BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With the API shared secret, an attacker can (for example) use api/join to join an arbitrary meeting regardless of its guestPolicy setting.