Vulnerability Details CVE-2020-27602
BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 66.3%
CVSS Severity
CVSS v3 Score 9.8
References
- https://github.com/bigbluebutton/bigbluebutton/commit/4bfd924c64da2681f4c037026021f47eb189d717
- https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.6...v2.2.7
- https://github.com/bigbluebutton/bigbluebutton/commit/4bfd924c64da2681f4c037026021f47eb189d717
- https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.6...v2.2.7
Products affected by CVE-2020-27602
-
cpe:2.3:a:bigbluebutton:bigbluebutton:-
-
cpe:2.3:a:bigbluebutton:bigbluebutton:0.7
-
cpe:2.3:a:bigbluebutton:bigbluebutton:0.71
-
cpe:2.3:a:bigbluebutton:bigbluebutton:0.8
-
cpe:2.3:a:bigbluebutton:bigbluebutton:0.81
-
cpe:2.3:a:bigbluebutton:bigbluebutton:0.9.0
-
cpe:2.3:a:bigbluebutton:bigbluebutton:0.9.1
-
cpe:2.3:a:bigbluebutton:bigbluebutton:0.9.2
-
cpe:2.3:a:bigbluebutton:bigbluebutton:1.0.0
-
cpe:2.3:a:bigbluebutton:bigbluebutton:1.1.0
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.0
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.0
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.1
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.2
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.3
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.4
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.5
-
cpe:2.3:a:bigbluebutton:bigbluebutton:2.2.6