CVE-2022-36028: BigBlueButton Greenlight Open Redirect vulnerability
Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked the value of the returnto cookie. Versions 2.13.0 contains a patch for the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36028?
CVE-2022-36028 has been classified as a moderate severity vulnerability due to the potential for open redirects.
How do I fix CVE-2022-36028?
To mitigate CVE-2022-36028, update your BigBlueButton Greenlight installation to version 2.13.0 or later.
What systems are affected by CVE-2022-36028?
CVE-2022-36028 affects BigBlueButton Greenlight versions prior to 2.13.0.
What is an open redirect vulnerability as seen in CVE-2022-36028?
An open redirect vulnerability allows attackers to redirect users to arbitrary websites, potentially leading to phishing attacks.
Can CVE-2022-36028 be exploited without authentication?
Yes, CVE-2022-36028 can be exploited by unauthenticated users through the vulnerable login page.