Cross-Site Scripting Vulnerability in BigBlueButton Greenlight by BigBlueButton
CVE-2020-27642

6.1MEDIUM

Key Information:

Vendor

Bigbluebutton

Status
Greenlight
Vendor
CVE Published:
22 October 2020

What is CVE-2020-27642?

A cross-site scripting (XSS) vulnerability is found in the 'merge account' functionality of BigBlueButton Greenlight version 2.7.6. This flaw could allow an attacker to inject malicious scripts into web pages viewed by users, potentially compromising user sessions or exposing sensitive information.

References

https://github.com/bigbluebutton/greenlight/pull/2214
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.