CVE-2020-27606

BigBlueButton before 2.2.28 or earlier does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2020-27606

BigBlueButton is affected pre-2.2.28: the session cookie is not marked Secure in HTTPS, enabling cookie capture if an attacker can observe HTTP traffic. Affected product: BigBlueButton; vulnerable component: session cookie handling; root cause: absence of Secure flag on the cookie in HTTPS sessio...