CVE-2020-27608

In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a…

published October 21, 2020

CVSS
—
EPSS
1%
Percentile
56.7
In the wild
Unconfirmed
What it is

In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00819 · 56.7th percentile
Published
2020-10-21T14:07Z
EPSS history
Timeline
  • 21 OCT 14:07Z
    In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a…
    cvelistv5