PT-2020-16741 · Bigbluebutton · Bigbluebutton Greenlight

Farhatahmad · Published 2020-10-22 · Updated 2020-10-27 · CVE-2020-27642

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions BigBlueButton Greenlight version 2.7.6

Description A cross-site scripting (XSS) issue exists in the 'merge account' functionality in admins.js. This could potentially allow for malicious script execution.

Recommendations For BigBlueButton Greenlight version 2.7.6, consider disabling the 'merge account' functionality in admins.js until a patch is available to prevent potential exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-27642

Affected Products

Bigbluebutton Greenlight

References · 4

• https://github.com/bigbluebutton/greenlight/pull/2214 · Patch
• https://osv.dev/vulnerability/CVE-2020-27642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27642 · Security Note
• https://t.me/cibsecurity/15519 · Telegram Post