Unscored CVE-2020-26163 EUVD-2020-18788GHSA-5wp7-85p7-qq6v

BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follow…

Published Sep 30, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Description

BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link.

References

https://www.sakshamanand.com/host-header-injection-bigbluebutton/
https://github.com/bigbluebutton/greenlight/releases/tag/release-2.5.6
https://github.com/bigbluebutton/greenlight/pull/1543