PT-2022-4370 · Unknown · Greenlight

Published 2022-08-22 · Updated 2025-04-24 · CVE-2022-36029

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Greenlight versions prior to 2.13.0

Description The issue is related to an open redirect vulnerability in the Login page of Greenlight, which is an end-user interface for BigBlueButton servers. This vulnerability is due to the unchecked value of the return to cookie.

Recommendations For versions prior to 2.13.0, update to version 2.13.0 to resolve the issue. As a temporary workaround, consider restricting access to the Login page or disabling the use of the return to cookie until the patch is applied.

Exploit

Fix

Open Redirect

Insufficient Session Expiration

Weakness Enumeration

CWE-601

CWE-613

Related Identifiers

BDU:2022-05233

CVE-2022-36029

Affected Products

Greenlight

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36029.json · Exploit
• https://github.com/bigbluebutton/greenlight/commit/20fe1ee71b5703fcc4ed698a959ad224fed19623 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36029 · Security Note
• https://bdu.fstec.ru/vul/2022-05233 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36029 · Vendor Advisory
• https://github.com/bigbluebutton/greenlight/commit/e22d0476b6e78a710a1550a95bbf598aa51b14c1 · Note
• https://github.com/bigbluebutton/greenlight · Note
• https://huntr.dev/bounties/9b341840-fd3f-4a21-839f-ad1fcb422a0e · Note
• https://t.me/cvenotify/119651 · Telegram Post
• https://t.me/cvenotify/78051 · Telegram Post
• https://huntr.com/bounties/ba5834bd-1f04-4936-8e93-2442d45403bahttps: · Note