CVE-2020-27604

BigBlueButton before 2.3 does not implement LibreOffice sandboxing

published October 21, 2020

CVSS
—
EPSS
1%
Percentile
66.5
In the wild
Unconfirmed
What it is

BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With the API shared secret, an attacker can (for example) use api/join to join an arbitrary meeting regardless of its guestPolicy setting.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01147 · 66.5th percentile
Published
2020-10-21T14:09Z
EPSS history
Timeline
  • 21 OCT 14:09Z
    BigBlueButton before 2.3 does not implement LibreOffice sandboxing
    cvelistv5