CVE-2022-36028 - BigBlueButton Greenlight Open Redirect vulnerability

Back Back to CVE browser

CRITICAL

BigBlueButton Greenlight Open Redirect vulnerability

Published Apr 25, 2024

9.1

CRITICAL

CVSS 3.1

EPSS 0.36%

Description

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the `return_to` cookie. Versions 2.13.0 contains a patch for the issue.

Affected products

Vendor Bigbluebutton Product Greenlight Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.13.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bigbluebutton

Greenlight

unaffected

Version	Status	Constraints
0	affected	<2.13.0

Vendor Bigbluebutton Product Greenlight Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Bigbluebutton

Greenlight

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-601

Open Redirect

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38808
Advisory
https://github.com/bigbluebutton/greenlight/commit/20fe1ee71b5703fcc4ed698a959ad224fed19623
Patch
https://huntr.com/bounties/ba5834bd-1f04-4936-8e93-2442d45403bahttps://
Broken LinkThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-38808		Advisory
https://github.com/bigbluebutton/greenlight/commit/20fe1ee71b5703fcc4ed698a959ad224fed19623		Patch
https://huntr.com/bounties/ba5834bd-1f04-4936-8e93-2442d45403bahttps://		Broken LinkThird Party Advisory