PT-2020-16320 · Bigbluebutton · Bigbluebutton Greenlight

Saksham Anand · Published 2020-09-30 · Updated 2020-10-15 · CVE-2020-26163

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BigBlueButton Greenlight versions prior to 2.5.6

Description The issue allows HTTP header attacks, specifically targeting the Host and Origin headers, which can lead to account takeover. This can occur when a victim follows a spoofed password-reset link.

Recommendations For versions prior to 2.5.6, update to version 2.5.6 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2020-26163

Affected Products

Bigbluebutton Greenlight

References · 5

• 🔥 https://sakshamanand.com/host-header-injection-bigbluebutton · Exploit
• https://github.com/bigbluebutton/greenlight/pull/1543 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26163 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26163 · Vendor Advisory
• https://github.com/bigbluebutton/greenlight/releases/tag/release-2.5.6 · Note