CVE-2022-36028

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-36028

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36028.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-36028

Published

2024-04-25T20:36:37.543Z

Modified

2026-07-15T01:49:21.860358036Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

BigBlueButton Greenlight Open Redirect vulnerability

Details

Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the return_to cookie. Versions 2.13.0 contains a patch for the issue.

Database specific

{
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36028.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/bigbluebutton/greenlight

Affected ranges

Type

GIT

Repo

https://github.com/bigbluebutton/greenlight

Events

Introduced

Fixed

3622a25e134eaea16eadc8795ebc05df9461ceeb

Fixed

20fe1ee71b5703fcc4ed698a959ad224fed19623

Database specific

{
    "cpe": "cpe:2.3:a:bigbluebutton:greenlight:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.13.0"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

release-2.*

release-2.0.0

release-2.0.1

release-2.0.2

release-2.0.3

release-2.0.4

release-2.0.5

release-2.0.6

release-2.0.7

release-2.0.8

release-2.0.9

release-2.1.0

release-2.1.1

release-2.1.2

release-2.1.3

release-2.10.0

release-2.10.0.1

release-2.10.0.1-beta.1

release-2.10.0.2

release-2.10.0.3

release-2.11.0

release-2.11.1

release-2.11.2

release-2.12.0

release-2.12.1

release-2.12.1.1

release-2.12.1.1-beta.1

release-2.12.2

release-2.12.2.1

release-2.12.3

release-2.12.4

release-2.12.5

release-2.12.6

release-2.12.6-beta.1

release-2.2.0

release-2.2.1

release-2.2.2

release-2.2.3

release-2.3.0

release-2.3.1

release-2.3.2

release-2.3.3

release-2.3.4

release-2.4

release-2.4-b1

release-2.4-b2

release-2.4-b3

release-2.4-rc1

release-2.4.1

release-2.4.2

release-2.4.2-rc.1

release-2.5

release-2.5-rc.1

release-2.5.1

release-2.5.2

release-2.5.3

release-2.5.5

release-2.5.6

release-2.6

release-2.6.1

release-2.6.2

release-2.6.3

release-2.6.4

release-2.6.5

release-2.7

release-2.7.1

release-2.7.10

release-2.7.11

release-2.7.12

release-2.7.13

release-2.7.14

release-2.7.15

release-2.7.15.1

release-2.7.16

release-2.7.17

release-2.7.18

release-2.7.19

release-2.7.2

release-2.7.20

release-2.7.3

release-2.7.4

release-2.7.5

release-2.7.6

release-2.7.7

release-2.7.8

release-2.7.9

release-2.8

release-2.8.1

release-2.8.2

release-2.8.2.1

release-2.8.2.2

release-2.8.3

release-2.8.4

release-2.8.5

release-2.8.6

release-2.8.7

release-2.9.0

release-2.9.1

release-2.9.2

release-2.9.3-beta.1

release-2.9.3-beta.2

release-2.9.3-beta.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-36028.json"