CVE-2020-12443 | BDVDB-2026-135384 Detail

Description#

BigBlueButton before 2.2.6 allows remote attackers to read arbitrary files because the presfilename (lowercase) value can be a .pdf filename while the presFilename (mixed case) value has a ../ sequence. This can be leveraged for privilege escalation via a directory traversal to bigbluebutton.properties. NOTE: this issue exists because of an ineffective mitigation to CVE-2020-12112 in which there was an attempted fix within an NGINX configuration file, without considering that the relevant part of NGINX is case-insensitive.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12020-04-29Record published in the CVE List.
2. Version 22024-08-04Most recent update recorded in the CVE List.