by Kastro
Paper/Archive/CVE-2022-36029

CVE-2022-36029

bigbluebutton greenlight — BigBlueButton Greenlight Open Redirect vulnerability

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 35.3.353 × 207.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.

Affected

ProductAffectedFixed inSource
greenlight< 2.13.02.13.0CNA
greenlight< 2.13.02.13.0CISA-ADP

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhuntr.com/bounties/ba5834bd-1f04-4936-8e93-2442d45403bahttps:/refgithub.com/bigbluebutton/greenlight/commit/20fe1ee71b5703fcc4ed698a959ad224fed19623