An issue exists in BigBlueButton up to and including 2.2.29. When at attacker is able to view an account_activations/edit?token= URI, the attacker can create an approved user account associated with an email address that has an arbitrary domain name.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
bigbluebutton bigbluebutton |