← back
CVE-2020-25820

CVE-2020-25820

EPSS 8.8%
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/159667/BigBlueButton-2.2.25-File-Disclosure-Server-Side-Request-Forgery.htmlunverifiedexploitdbwww.exploit-db.com/exploits/49070unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/159667/BigBlueButton-2.2.25-File-Disclosure-Server-Side-Request-Forgery.htmlhttps://github.com/bigbluebutton/bigbluebutton/commit/71fe1eac1e5bd73a2cd44bd79c001086b250e435https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.26...v2.2.27https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.htmlhttps://www.redteam-pentesting.de/advisories/rt-sa-2020-005