CVE-2022-31039: Improper privilege management - Anyone can view room settings in GreenLight
Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in release version 2.12.6.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-31039?
CVE-2022-31039 is a vulnerability in BigBlueButton Greenlight that allows unauthorized users to view a room's settings.
How does CVE-2022-31039 affect BigBlueButton Greenlight?
CVE-2022-31039 affects BigBlueButton Greenlight by allowing unauthorized users to view a room's settings.
What is the severity of CVE-2022-31039?
The severity of CVE-2022-31039 is medium with a CVSS score of 5.3.
How can an attacker exploit CVE-2022-31039?
An attacker can exploit CVE-2022-31039 by accessing the settings of a room they are not authorized to view.
How to fix CVE-2022-31039?
To fix CVE-2022-31039, it is recommended to update BigBlueButton Greenlight to a version higher than 2.12.6.