PT-2022-7317 · Unknown · Greenlight

Published 2022-06-11 · Updated 2025-04-24 · CVE-2022-36028

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Greenlight versions prior to 2.13.0

Description The issue is related to an open redirect vulnerability in the Login page of Greenlight, which is an end-user interface for BigBlueButton servers. This vulnerability is due to the unchecked value of the return to cookie. It allows a remote attacker to redirect a user to an arbitrary URL.

Recommendations For versions prior to 2.13.0, update to version 2.13.0 to resolve the issue. As a temporary workaround, consider restricting the use of the return to cookie in the Login page until a patch is applied.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2024-03306

CVE-2022-36028

Affected Products

Greenlight

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36028.json · Exploit
• https://github.com/bigbluebutton/greenlight/commit/20fe1ee71b5703fcc4ed698a959ad224fed19623 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36028 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36028 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03306 · Security Note
• https://github.com/bigbluebutton/greenlight · Note
• https://t.me/cvenotify/119650 · Telegram Post
• https://t.me/cvenotify/78050 · Telegram Post
• https://vuldb.com/zh/?id.262041 · Note
• https://huntr.com/bounties/ba5834bd-1f04-4936-8e93-2442d45403ba · Note
• https://huntr.com/bounties/ba5834bd-1f04-4936-8e93-2442d45403bahttps: · Note