CVE-2020-27601

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

In BigBlueButton before 2.2.7, lockSettingsProps.disablePrivateChat does not apply to already opened chats. This occurs in bigbluebutton-html5/imports/ui/components/chat/service.js.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-668

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bigbluebutton/bigbluebutton/commit/7dcdfb191373684bafa7b11cdd0128c9869040a1Patch, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.6...v2.2.7Release Notes, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/commit/7dcdfb191373684bafa7b11cdd0128c9869040a1Patch, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.6...v2.2.7Release Notes, Third Party Advisory

Timeline

Published: Sep 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-276029.8BigBlueButton before 2.2.7 does not have a protection mechanism for separator injection in meetingId, userId, and authToken.CVE-2020-276037.5BigBlueButton before 2.2.27 has an unsafe JODConverter setting in which LibreOffice document conversions can access external files.CVE-2020-276046.5BigBlueButton before 2.3 does not implement LibreOffice sandboxing. This might make it easier for remote authenticated users to read the API CVE-2020-276059.8BigBlueButton through 2.2.28 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related t CVE-2020-276065.3BigBlueButton before 2.2.28 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for CVE-2020-276076.5In BigBlueButton before 2.2.28 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data fro CVE-2020-276086.1In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as CVE-2020-276095.3BigBlueButton through 2.2.28 records a video meeting despite the deactivation of video recording in the user interface. This may result in d CVE-2020-27614.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected ar CVE-2020-276107.5The installation procedure in BigBlueButton before 2.2.28 (or earlier) exposes certain network services to external interfaces, and does not CVE-2020-276117.3BigBlueButton through 2.2.28 uses STUN/TURN resources from a third party, which may represent an unintended endpoint.CVE-2020-276124.3Greenlight in BigBlueButton through 2.2.28 places usernames in room URLs, which may represent an unintended information leak to users in a r