PT-2020-16711 · Bigbluebutton · Bigbluebutton

Published 2020-10-21 · Updated 2022-10-03 · CVE-2020-27601

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.2.7

Description The issue arises from the lockSettingsProps.disablePrivateChat setting not being applied to chats that are already open. This problem is located in the bigbluebutton-html5/imports/ui/components/chat/service.js file.

Recommendations For versions prior to 2.2.7, update to version 2.2.7 or later to resolve the issue. As a temporary workaround, consider disabling the private chat feature until a patch is available.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2020-27601

Affected Products

Bigbluebutton

References · 5

• https://github.com/bigbluebutton/bigbluebutton/commit/7dcdfb191373684bafa7b11cdd0128c9869040a1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-27601 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27601 · Vendor Advisory
• https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.6...v2.2.7 · Note
• https://t.me/cibsecurity/50673 · Telegram Post