PT-2022-20479 · Unknown · Greenlight

Published 2022-06-27 · Updated 2022-07-07 · CVE-2022-31039

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Greenlight versions prior to 2.12.6

Description Greenlight is a simple front-end interface for a BigBlueButton server. In affected versions, an attacker can view any room's settings, even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings.

Recommendations For versions prior to 2.12.6, update to release version 2.12.6 to resolve the issue.

Exploit

Fix

Incorrect Authorization

Improper Privilege Management

Weakness Enumeration

CWE-863

CWE-269

Related Identifiers

CVE-2022-31039

GHSA-PHH8-3V6V-7498

Affected Products

Greenlight

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31039.json · Exploit
• https://github.com/bigbluebutton/greenlight/pull/3508 · Patch
• https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31039 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31039 · Vendor Advisory
• https://t.me/cvenotify/32256 · Telegram Post
• https://t.me/cibsecurity/45228 · Telegram Post