BigBlueButton 代码问题漏洞

漏洞信息详情

BigBlueButton是BigBlueButton社区的一套开源的Web会议系统。

BigBlueButton 2.2.7之前版本存在安全漏洞，该漏洞允许攻击者读取本地文件，并通过上传的Office文档进行SSRF攻击，该文档在ODF xlink字段中有一个精心设计的URL。

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页：

https://bigbluebutton.org/

来源:MISC

链接:https://www.redteam-pentesting.de/advisories/rt-sa-2020-005

来源:MISC

链接:https://www.golem.de/news/big-blue-button-das-grosse-blaue-sicherheitsrisiko-2010-151610.html

来源:MISC

链接:https://packetstormsecurity.com/files/159667/BigBlueButton-2.2.25-File-Disclosure-Server-Side-Request-Forgery.html

来源:MISC

链接:https://github.com/bigbluebutton/bigbluebutton/compare/v2.2.26...v2.2.27

来源:MISC

链接:https://github.com/bigbluebutton/bigbluebutton/commit/71fe1eac1e5bd73a2cd44bd79c001086b250e435

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-25820

来源:www.exploit-db.com

链接:https://www.exploit-db.com/exploits/49070

暂无

暂无