CVE-2020-12112 : BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via

BigBlueButton before 2.2.5 allows remote attackers to obtain sensitive files via Local File Inclusion.

Published 2020-04-23 18:15:12

Updated 2022-10-05 18:38:07

Source MITRE

View at NVD, CVE.org

Vulnerability category: Directory traversalFile inclusion

Products affected by CVE-2020-12112

Bigbluebutton » Bigbluebutton
Versions before (<) 2.2.5
cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Assigned by: nvd@nist.gov (Primary)

https://cwe.mitre.org/data/definitions/23.html

CWE - CWE-23: Relative Path Traversal (4.8)
Third Party Advisory

CVEs referencing this url
https://twitter.com/bigbluebutton/status/1252706369486180353

BigBlueButton on Twitter: "@flipr3verse Yes, the fix to the reported vulnerability (thanks to @thibeault_chenu for responsible disclosure) is in 2.2.5. You can see your version by running 'sudo bbb-co
Third Party Advisory
https://github.com/tchenu/CVE-2020-12112

GitHub - tchenu/CVE-2020-12112: BigBlueButton versions lower than 2.2.4 have a LFI vulnerability allowing access to sensitive files. 🚨
Exploit;Third Party Advisory
https://twitter.com/thibeault_chenu/status/1249976515917422593

Thibeault 👨🏻‍💻 on Twitter: "You must to update BigBlueButton to 2.2.5! https://t.co/nDMz5nZrX4 Versions lower than 2.2.4 contain a critical security vulnerability (LFI) that allows malicious users
Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.4...v2.2.5

Comparing v2.2.4...v2.2.5 · bigbluebutton/bigbluebutton · GitHub
Patch;Third Party Advisory

Jump to