CVE-2022-36028

2024-04-2521:15:46

CWE-601

[email protected]

web.nvd.nist.gov

greenlight

open redirect vulnerability

return_to cookie

bigbluebutton

version 2.13.0

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

26.1%

JSON

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the return_to cookie. Versions 2.13.0 contains a patch for the issue.

Affected configurations

Vulners

Node

bigbluebuttongreenlightRange<2.13.0

VendorProductVersionCPE
bigbluebuttongreenlight*cpe:2.3:a:bigbluebutton:greenlight:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
bigbluebutton	greenlight	*	cpe:2.3:a:bigbluebutton:greenlight::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "greenlight",
    "product": "greenlight",
    "repo": "https://github.com/bigbluebutton/greenlight",
    "vendor": "bigbluebutton",
    "versions": [
      {
        "lessThan": "2.13.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]