Description
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document.
Unscored
CVE-2020-27608
EUVD-2020-20115GHSA-43wq-r34m-56ch
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as…
Published Oct 21, 2020 · Updated Aug 4, 2024 · Assigned by mitre