CVE-2020-28954

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

web/controllers/ApiController.groovy in BigBlueButton before 2.2.29 lacks certain parameter sanitization, as demonstrated by accepting control characters in a user name.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-116

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bigbluebutton/bigbluebutton/commit/5c911ddeec4493f40f42e2f137800ed4692004a4Patch, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/commit/e59bcd0c33a6a3203c011faa8823ba2cac1e4f37Patch, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.28...v2.2.29Release Notes, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/issues/10818Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/commit/5c911ddeec4493f40f42e2f137800ed4692004a4Patch, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/commit/e59bcd0c33a6a3203c011faa8823ba2cac1e4f37Patch, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.28...v2.2.29Release Notes, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/issues/10818Third Party Advisory

Timeline

Published: Nov 19, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-289555.4SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allo CVE-2020-289565.4Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web script CVE-2020-289575.4Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web CVE-2020-28964.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions that are affected are CVE-2020-289609.8Chichen Tech CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the file product_list.php via the id and cid param CVE-2020-289615.4Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the comp CVE-2020-289637.8Passcovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function.CVE-2020-289646.7Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Search function. This vulnerability allows atta CVE-2020-289678.8FlashGet v1.9.6 was discovered to contain a buffer overflow in the 'current path directory' function. This vulnerability allows attackers to CVE-2020-289685.4Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module.CVE-2020-289697.8Aplioxio PDF ShapingUp 5.0.0.139 contains a buffer overflow which allows attackers to cause a denial of service (DoS) via a crafted PDF file CVE-2020-28974.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.19 an