CVE-2020-12443

Katalog CVE

CVSS 9.8 · Critical EPSS 3,7%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada bigbluebutton. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to bigbluebutton.properties. NOTE: this issue exists because of an ineffective mitigation to CVE-2020-12112 in which there was an attempted fix within an NGINX configuration file, without considering that the relevant part of NGINX is case-insensitive.

Rincian

Terbit di NVD

29 April 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

3,7% peluang dieksploitasi; lebih tinggi dari 89,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bigbluebutton/bigbluebutton/pull/9259/commits/b21ca8355a57286a1e6df96984b3a4c57679a463 patch · advisory pihak ketiga
• https://github.com/mclab-hbrs/BBB-POC exploit · advisory pihak ketiga