PT-2020-16722

Name of the Vulnerable Software and Affected Versions BigBlueButton versions 2.2.8 through 2.2.28 Description The issue concerns an unintended information leak. Usernames are placed in room URLs, which may leak information to users in the same room or to outsiders if a user publishes a screenshot...

PT-2020-16719

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.3 Description The issue allows BigBlueButton to record a video meeting even when the video recording feature is deactivated in the user interface. This can lead to unauthorized data storage for specific meetin...

PT-2020-16721

Name of the Vulnerable Software and Affected Versions BigBlueButton versions 2.2.8 through 2.2.28 Description The issue concerns BigBlueButton using STUN/TURN resources from a third party, potentially representing an unintended endpoint. There is no information provided about the estimated number...

PT-2020-16720

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.2.28 Description The installation procedure exposes certain network services to external interfaces and does not automatically set up a firewall configuration to block external access. Recommendations For...

BigBlueButton 2.2.25 File Disclosure / Server-Side Request Forgery

Advisory: Arbitrary File Disclosure and Server-Side Request Forgery in BigBlueButton RedTeam Pentesting discovered a vulnerability in the BigBlueButton web conferencing system which allows participants of a conference with permissions to upload presentations to read arbitrary files from the file...

PT-2020-16225

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.2.7 Description The issue allows remote authenticated users to read local files and conduct Server-Side Request Forgery SSRF attacks. This is achieved by uploading an Office document that contains a crafted UR...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

Design/Logic Flaw

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 is affected by an HTTP header (Host and Origin) input issue that enables account takeover when a user clicks a spoofed password‑reset link. Root cause: header handling allows spoofing of origins/hosts. Impact: potential account compromise; attacks require net...

CVE-2020-26163

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

CVE-2020-26163: Undefined Security Weakness

BigBlueButton Greenlight before 2.5.6 allows HTTP header Host and Origin attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link...

PT-2020-16320

Name of the Vulnerable Software and Affected Versions BigBlueButton Greenlight versions prior to 2.5.6 Description The issue allows HTTP header attacks, specifically targeting the Host and Origin headers, which can lead to account takeover. This can occur when a victim follows a spoofed...

CVE-2020-12443

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...

CVE-2020-12443

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...

Directory traversal

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...

CVE-2020-12443

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...

CVE-2020-12443

CVE-2020-12443 affects BigBlueButton before 2.2.6, allowing remote read of files via directory traversal: presfilename (lowercase) can be a .pdf while presFilename (mixed case) contains ../, enabling traversal to bigbluebutton.properties. The issue ties to an ineffective mitigation for CVE-2020-1...

CVE-2020-12443

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename lowercase value can be a .pdf filename while the presFilename mixed case value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to...