medium6.1
CVE-2020-27608
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .…
Impact
In BigBlueButton before 2.2.28 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bigbluebutton | Bigbluebutton | before 2.2.28 |