CVE-2020-25820

PoC ×2—

CVSS 3.1

6.5 medium

EPSS

10%p95

Published

Oct 21, 2020 (Oct 21, 2020)

Modified

Jun 17, 2026

Description

BigBlueButton before 2.2.7 allows remote authenticated users to read local files and conduct SSRF attacks via an uploaded Office document that has a crafted URL in an ODF xlink field.

Vendors: bigbluebutton
Products: bigbluebutton
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (10.5%)

In the news0 stories

No ingested article mentions this CVE yet.