Login Request a demo
Medium severity · published Jun 27, 2022
CVE-2022-31039
Greenlight is a simple front-end interface for your BigBlueButton server
5.3
CVSS
0.7%
EPSS
No
On KEV
Description
Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in release version 2.12.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Greenlight · Bigbluebutton
before 2.12.6 · source: NVD
Affected product
GR
Greenlight
Bigbluebutton
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31039
Patch
https://github.com/bigbluebutton/greenlight/pull/3508
Patch
https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498
More from Greenlight
8.8
CVE-2020-26163
BigBlueButton Greenlight before 2.5.6 allows HTTP header (Host and Origin) attacks, which can result in Account Takeover if a victim follows a spoofed password-reset link
6.1
CVE-2022-36029
BigBlueButton Greenlight Open Redirect vulnerability
6.1
CVE-2022-36028
BigBlueButton Greenlight Open Redirect vulnerability
6.1
CVE-2020-27642
A cross-site scripting (XSS) vulnerability exists in the 'merge account' functionality in admins.js in BigBlueButton Greenlight 2.7.6
5.4
CVE-2022-26497
BigBlueButton Greenlight 2.11.1 allows XSS