Lucene search

GoogleOSV:CVE-2022-36028

HistoryApr 25, 2024 - 9:15 p.m.

CVE-2022-36028

2024-04-2521:15:46

Google

osv.dev

greenlight

open redirect

vulnerability

patched

version 2.13.0

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.1%

JSON

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the return_to cookie. Versions 2.13.0 contains a patch for the issue.

CPENameOperatorVersion
greenlighteqrelease-2.3.0
greenlighteqrelease-2.4-b3
greenlighteqrelease-2.2.1
greenlighteqrelease-2.6.3
greenlighteqrelease-2.7.5
greenlighteqrelease-2.1.3
greenlighteqrelease-2.0.7
greenlighteqrelease-2.0.3
greenlighteqrelease-2.5
greenlighteqrelease-2.10.0.1

Name	Operator	Version
greenlight	eq	release-2.3.0
greenlight	eq	release-2.4-b3
greenlight	eq	release-2.2.1
greenlight	eq	release-2.6.3
greenlight	eq	release-2.7.5
greenlight	eq	release-2.1.3
greenlight	eq	release-2.0.7
greenlight	eq	release-2.0.3
greenlight	eq	release-2.5
greenlight	eq	release-2.10.0.1

Rows per page:

1-10 of 1031

References

github.com/bigbluebutton/greenlight/commit/20fe1ee71b5703fcc4ed698a959ad224fed19623

huntr.com/bounties/ba5834bd-1f04-4936-8e93-2442d45403bahttps://

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.1%

JSON

Related for OSV:CVE-2022-36028