PT-2020-16717 · Bigbluebutton · Bigbluebutton

Published 2020-10-21 · Updated 2020-10-29 · CVE-2020-27607

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 2.2.28

Description The issue arises from the client-side Mute button's behavior, which only signals the server to stop accepting audio data from the client but does not directly configure the client to stop sending audio data. This could allow a modified server to store the audio data and/or transmit it to meeting participants or third parties.

Recommendations For versions prior to 2.2.28, update to version 2.2.28 or later to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2020-27607

Affected Products

Bigbluebutton

References · 3

• 🔥 https://golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-27607 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27607 · Security Note