Vulmon
Proof Of Concept Exploits For BBB
BigBlueButton Vulnerabilities This is a collection of BBB security vulnerabilities we found: Local File Inclusion, CVE-2020-12443 Privilege Escalation Arbitrary File Write
BigBlueButton prior to 2.2.6 allows remote malicious users to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to bigbluebutton.properties. NOTE: this issue exists because of an ineffective mitigation to CVE-2020-12112 in which there was an attempted fix within an NGINX configuration file, without considering that the relevant part of NGINX is case-insensitive.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
bigbluebutton bigbluebutton |