CVE-2020-27607 : In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only si

In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or transmit it to one or more meeting participants or other third parties.

Published 2020-10-21 15:15:27

Updated 2020-10-29 17:04:14

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-27607

Bigbluebutton » Bigbluebutton
Versions before (<) 2.2.28
cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-27607

EPSS FAQ

0.23%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 42 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-27607

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:P/A:N	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	3.9	2.5	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None

References for CVE-2020-27607

https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.html

Golem.de: IT-News für Profis
Exploit;Third Party Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2020-27607

Products affected by CVE-2020-27607

Exploit prediction scoring system (EPSS) score for CVE-2020-27607

CVSS scores for CVE-2020-27607

References for CVE-2020-27607