← back
CVE-2020-25820

CVE-2020-25820

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 8.9%
from disclosure to weapon28 days
Published on NVDOct 21
1st PoC+28d
exploitation probability
8.9%top 5% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/159667/BigBlueButton-2.2.25-File-Disclosure-Server-Side-Request-Forgery.htmlunverifiedexploitdbwww.exploit-db.com/exploits/49070unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/159667/BigBlueButton-2.2.25-File-Disclosure-Server-Side-Request-Forgery.htmlhttps://github.com/bigbluebutton/bigbluebutton/commit/71fe1eac1e5bd73a2cd44bd79c001086b250e435https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.26...v2.2.27https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.htmlhttps://www.redteam-pentesting.de/advisories/rt-sa-2020-005