Greenlight BigBlueButton Servers Vulnerable to Open Redirect
CVE-2022-36028

6.1MEDIUM

Key Information:

Vendor

Bigbluebutton

Status
Greenlight
Vendor
CVE Published:
25 April 2024

What is CVE-2022-36028?

Greenlight, an end-user interface for BigBlueButton servers, is susceptible to an open redirect vulnerability due to improper validation of the 'return_to' cookie value. This oversight allows malicious actors to redirect users to untrusted destinations after login. It is crucial for users operating versions prior to 2.13.0 to upgrade to the patched version to mitigate any potential security risks associated with this vulnerability.

Affected Version(s)

greenlight 0 < 2.13.0

References

https://huntr.com/bounties/ba5834bd-1f04-4936-8e93-2442d4...
https://github.com/bigbluebutton/greenlight/commit/20fe1e...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.