CVE-2026-27466

{"id": "CVE-2026-27466", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "published": "2026-02-21T08:16:11.647", "references": [{"url": "https://github.com/bigbluebutton/bigbluebutton/commit/f3d33d94a9682e87c7d41f55700b19d61e1ab8b4", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wmhx-qw2p-w6gc", "tags": ["Patch", "Vendor Advisory", "Exploit"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-668"}]}], "descriptions": [{"lang": "en", "value": "BigBlueButton is an open-source virtual classroom. In versions 3.0.21 and below, the official documentation for \"Server Customization\" on Support for ClamAV as presentation file scanner contains instructions that leave a BBB server vulnerable for Denial of Service. The flawed command exposes both ports (3310 and 7357) to the internet. A remote attacker can use this to send complex or large documents to clamd and waste server resources, or shutdown the clamd process. The clamd documentation explicitly warns about exposing this port. Enabling ufw (ubuntu firewall) during install does not help, because Docker routes container traffic through the nat table, which is not managed or restricted by ufw. Rules installed by ufw in the filter table have no effect on docker traffic. In addition, the provided example also mounts /var/bigbluebutton with write permissions into the container, which should not be required. Future vulnerabilities in clamd may allow attackers to manipulate files in that folder. Users are unaffected unless they have opted in to follow the extra instructions from BigBlueButton's documentation. This issue has been fixed in version 3.0.22."}, {"lang": "es", "value": "BigBlueButton es un aula virtual de c\u00f3digo abierto. En las versiones 3.0.21 e inferiores, la documentaci\u00f3n oficial para 'Personalizaci\u00f3n del Servidor' en Soporte para ClamAV como esc\u00e1ner de archivos de presentaci\u00f3n contiene instrucciones que dejan un servidor BBB vulnerable a la denegaci\u00f3n de servicio. El comando defectuoso expone ambos puertos (3310 y 7357) a internet. Un atacante remoto puede usar esto para enviar documentos complejos o grandes a clamd y malgastar recursos del servidor, o apagar el proceso clamd. La documentaci\u00f3n de clamd advierte expl\u00edcitamente sobre la exposici\u00f3n de este puerto. Habilitar ufw (cortafuegos de ubuntu) durante la instalaci\u00f3n no ayuda, porque Docker enruta el tr\u00e1fico del contenedor a trav\u00e9s de la tabla nat, la cual no es gestionada ni restringida por ufw. Las reglas instaladas por ufw en la tabla de filtros no tienen efecto en el tr\u00e1fico de docker. Adem\u00e1s, el ejemplo proporcionado tambi\u00e9n monta /var/bigbluebutton con permisos de escritura en el contenedor, lo cual no deber\u00eda ser necesario. Futuras vulnerabilidades en clamd pueden permitir a los atacantes manipular archivos en esa carpeta. Los usuarios no se ven afectados a menos que hayan optado por seguir las instrucciones adicionales de la documentaci\u00f3n de BigBlueButton. Este problema ha sido solucionado en la versi\u00f3n 3.0.22."}], "lastModified": "2026-02-26T18:59:18.317", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bigbluebutton:bigbluebutton:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F947DE6-4258-49E7-923E-8607DFEA6708", "versionEndExcluding": "3.0.22"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}