Sandbox vulnerability in BigBlueButton by BigBlueButton Inc.
CVE-2020-27605

9.8CRITICAL

Key Information:

Vendor

Bigbluebutton

Status
Bigbluebutton
Vendor
CVE Published:
21 October 2020

What is CVE-2020-27605?

BigBlueButton versions up to 2.2.28 utilize Ghostscript for processing uploaded EPS documents, which exposes the system to potential attacks due to weaknesses in the sandbox environment. This vulnerability could allow unauthorized actions that compromise the integrity and security of the application, making it crucial for users and administrators to be aware of these risks and apply necessary mitigations.

References

https://www.golem.de/news/big-blue-button-das-grosse-blau...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.