PT-2020-16721 · Bigbluebutton · Bigbluebutton

Published 2020-10-21 · Updated 2022-06-15 · CVE-2020-27611

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BigBlueButton versions 2.2.8 through 2.2.28

Description The issue concerns BigBlueButton using STUN/TURN resources from a third party, potentially representing an unintended endpoint. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations For BigBlueButton versions 2.2.8 through 2.2.28, consider restricting access to the STUN/TURN resources from third parties to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2020-27611

Affected Products

Bigbluebutton

References · 6

• https://github.com/bigbluebutton/bigbluebutton/commit/d0bc77c3dbd858295004f15d7a57ec35e6b203d6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-27611 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27611 · Vendor Advisory
• https://t.me/cvenotify/5836 · Telegram Post
• https://t.me/cibsecurity/15486 · Telegram Post
• https://docs.bigbluebutton.org/admin/privacy.html · Note