CVE-2020-28954

web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name...

CVE-2020-28954

web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name...

CVE-2020-28954

BigBlueButton is affected by CVE-2020-28954 due to inadequate parameter sanitization in web/controllers/ApiController.groovy, allowing control characters to be accepted in a user name. This affects versions prior to 2.2.29. The vulnerability is described across multiple sources (NVD/Red Hat/CNVD)...