CVE-2020-29043

Published: Nov 26, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an account_activations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name.

Affected (1)

Products: Bigbluebutton: Bigbluebutton

Bigbluebutton

1 product

Bigbluebutton

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bigbluebutton Bigbluebutton	Up to 2.2.29

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

http://packetstormsecurity.com/files/160239/BigBlueButton-2.2.29-E-mail-Validation-Bypass.html

Source: cve@mitre.org

Third Party Advisory

https://cxsecurity.com/issue/WLB-2020110211

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/bigbluebutton/bigbluebutton/releases

Source: cve@mitre.org

Release NotesThird Party Advisory

http://packetstormsecurity.com/files/160239/BigBlueButton-2.2.29-E-mail-Validation-Bypass.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cxsecurity.com/issue/WLB-2020110211

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://github.com/bigbluebutton/bigbluebutton/releases

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesThird Party Advisory

Timeline

No history available yet.