Unintended Third-Party Endpoint Vulnerability in BigBlueButton by BigBlueButton
CVE-2020-27611

7.3HIGH

Key Information:

Vendor

Bigbluebutton

Status
Bigbluebutton
Vendor
CVE Published:
21 October 2020

What is CVE-2020-27611?

BigBlueButton versions up to 2.2.28 may utilize STUN/TURN resources from a third party, resulting in the potential exposure of an unintended endpoint. This vulnerability could lead to security implications when external entities misconfigure or improperly manage these services, affecting the integrity of communications made through the platform.

References

https://docs.bigbluebutton.org/admin/privacy.html
x_refsource_MISC
https://github.com/bigbluebutton/bigbluebutton/commit/d0b...
x_refsource_MISC

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.