CVE-2020-29042

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/160238/BigBlueButton-2.2.29-Brute-Force.htmlThird Party Advisory
https://cxsecurity.com/issue/WLB-2020110210Exploit, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/releasesRelease Notes, Third Party Advisory
http://packetstormsecurity.com/files/160238/BigBlueButton-2.2.29-Brute-Force.htmlThird Party Advisory
https://cxsecurity.com/issue/WLB-2020110210Exploit, Third Party Advisory
https://github.com/bigbluebutton/bigbluebutton/releasesRelease Notes, Third Party Advisory

Timeline

Published: Nov 26, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-290437.5An issue was discovered in BigBlueButton through 2.2.29. When at attacker is able to view an account_activations/edit?token= URI, the attack CVE-2020-290459.8The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize opera CVE-2020-290479.8The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operati CVE-2020-29058.2Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior CVE-2020-290507.5SphinxSearch in Sphinx Technologies Sphinx through 3.1.1 allows directory traversal (in conjunction with CVE-2019-14511) because the mysql c CVE-2020-290536.1HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.CVE-2020-290549.8An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,CVE-2020-290555.9An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,CVE-2020-290569.8An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,CVE-2020-290577.5An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,CVE-2020-290589.8An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,CVE-2020-290599.8An issue was discovered on CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104,