What’s Vulnerable › Vulnerabilities

CVE-2020-28954

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-11-19 · updated 2026-06-17
• Weakness: CWE-116

Description

web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name.

Affected products

• bigbluebutton: before 2.2.29 — fixed in 2.2.29

How to fix

Upgrade to a fixed version: bigbluebutton 2.2.29. Check the vendor advisory for mitigations.

References

• https://github.com/bigbluebutton/bigbluebutton/commit/5c911ddeec4493f40f42e2f137800ed4692004a4
• https://github.com/bigbluebutton/bigbluebutton/commit/e59bcd0c33a6a3203c011faa8823ba2cac1e4f37
• https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.28...v2.2.29
• https://github.com/bigbluebutton/bigbluebutton/issues/10818
• https://github.com/bigbluebutton/bigbluebutton/commit/5c911ddeec4493f40f42e2f137800ed4692004a4
• https://github.com/bigbluebutton/bigbluebutton/commit/e59bcd0c33a6a3203c011faa8823ba2cac1e4f37
• https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.28...v2.2.29
• https://github.com/bigbluebutton/bigbluebutton/issues/10818

Get alerted when CVE-2020-28954 or the next vulnerability affects your stack