CVE-2020-27601

In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js...

CVE-2020-27601

BigBlueButton before 2.2.7: the setting lockSettingsProps.disablePrivateChat is not applied to chats that are already open. Root cause is in bigbluebutton-html5/imports/ui/components/chat/service.js. Impact is that private-chat restrictions may not be enforced for existing chats (low severity per...

CVE-2020-27601

In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js...

CVE-2020-27603

BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...

CVE-2020-27603

BigBlueButton prior to 2.2.27 is affected by an unsafe JODConverter setting that allows LibreOffice document conversions to access external files. The root cause is the JODConverter configuration used during server-side rendering, enabling potential data exfiltration via LibreOffice processing. T...

CVE-2020-27603

BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files...

CVE-2020-27604

BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With the API shared secret, an attacker can for example use api/join to join an arbitrary meeting...

CVE-2020-27604

BigBlueButton before 2.3 does not implement LibreOffice sandboxing, enabling remote authenticated users to read the API shared secret in bigbluebutton.properties and potentially join arbitrary meetings via api/join regardless of guestPolicy. Affected software: BigBlueButton prior to 2.3. Root cau...

CVE-2020-27605

BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."...

CVE-2020-27605

Technical details about CVE-2020-27605 are not publicly available in the provided connected documents. Monitor for updates from official sources to assess affected components, impact, and remediation.

CVE-2020-27607

In BigBlueButton before 2.2.28 or earlier, the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or...

CVE-2020-27607

In BigBlueButton before 2.2.28 or earlier, the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or...

CVE-2020-27607

CVE-2020-27607 affects BigBlueButton before 2.2.28. The client-side Mute button does not directly stop sending audio; it only signals the server to stop accepting audio data. A modified server could store audio data and/or transmit it to participants or third parties. Affected component: client-s...

CVE-2020-27609

BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond what is authorized for a specific meeting topic or participant...

CVE-2020-27609

CVE-2020-27609 affects BigBlueButton up to version 2.2.28, where video meetings are recorded despite the user interface indicating that video recording is deactivated. The result is potential data storage beyond what is authorized for a given meeting topic or participant. The connected Red Hat an...

CVE-2020-27611

BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint...

CVE-2020-27611

CVE-2020-27611 affects BigBlueButton up to version 2.2.28 . The issue, described across sources, is that BigBlueButton uses STUN/TURN resources from a third party, which may represent an unintended endpoint. The publicly provided documents do not specify a concrete root cause in code, a CVE-preci...

CVE-2020-27611

BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint...

CVE-2020-27613

The installation procedure in BigBlueButton before 2.2.28 or earlier uses ClueCon as the FreeSWITCH password, which allows local users to achieve unintended FreeSWITCH access...

CVE-2020-27613

Summary: CVE-2020-27613 affects BigBlueButton before 2.2.28 where the installation procedure uses ClueCon as the FreeSWITCH password, enabling local users to gain unintended FreeSWITCH access. Affected software: BigBlueButton (versions before 2.2.28). Vulnerability details: Local authentication w...