Description
BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.
Exploits (1)
exploitdb
WORKING POC
by RedTeam Pentesting GmbH · textwebappsmultiple
https://www.exploit-db.com/exploits/49070
References (5)
Scores
CVSS v3
6.5
EPSS
0.0395
EPSS Percentile
88.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-918
Status
published
Products (1)
bigbluebutton/bigbluebutton
< 2.2.27
Published
Oct 21, 2020
Tracked Since
Feb 18, 2026