Medium severity6.5NVD Advisory· Published Oct 21, 2020· Updated Jun 17, 2026
CVE-2020-27604
CVE-2020-27604
Description
BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With the API shared secret, an attacker can (for example) use api/join to join an arbitrary meeting regardless of its guestPolicy setting.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*range: <2.2.8
- (no CPE)range: <2.3
- BigBlueButton/BigBlueButtondescription
Patches
Vulnerability mechanics
References
2- www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.htmlnvdExploitThird Party Advisory
- docs.bigbluebutton.org/dev/api.htmlnvdProduct
News mentions
0No linked articles in our index yet.