What’s Vulnerable › Vulnerabilities

CVE-2020-27604

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-21 · updated 2026-06-17
• Weakness: CWE-116

Description

BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API shared secret in the bigbluebutton.properties file. With the API shared secret, an attacker can (for example) use api/join to join an arbitrary meeting regardless of its guestPolicy setting.

Affected products

• bigbluebutton: before 2.2.8 — fixed in 2.2.8

How to fix

Upgrade to a fixed version: bigbluebutton 2.2.8. Check the vendor advisory for mitigations.

References

• https://docs.bigbluebutton.org/dev/api.html
• https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.html
• https://docs.bigbluebutton.org/dev/api.html
• https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.html

Get alerted when CVE-2020-27604 or the next vulnerability affects your stack