CVE-2022-31039 (GCVE-0-2022-31039)
Vulnerability from cvelistv5
Published
2022-06-27 19:25
Modified
2025-04-23 18:07
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-269 - Improper Privilege Management
Summary
Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in release version 2.12.6.
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| bigbluebutton | greenlight |
Version: < 2.12.6 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T07:03:40.228Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/bigbluebutton/greenlight/pull/3508"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-31039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T14:04:40.869036Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T18:07:57.100Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "greenlight",
"vendor": "bigbluebutton",
"versions": [
{
"status": "affected",
"version": "\u003c 2.12.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room\u0027s settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room\u0027s settings. This issue has been patched in release version 2.12.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-27T19:25:12.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/bigbluebutton/greenlight/pull/3508"
}
],
"source": {
"advisory": "GHSA-phh8-3v6v-7498",
"discovery": "UNKNOWN"
},
"title": "Improper privilege management - Anyone can view room settings in GreenLight",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-31039",
"STATE": "PUBLIC",
"TITLE": "Improper privilege management - Anyone can view room settings in GreenLight"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "greenlight",
"version": {
"version_data": [
{
"version_value": "\u003c 2.12.6"
}
]
}
}
]
},
"vendor_name": "bigbluebutton"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room\u0027s settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room\u0027s settings. This issue has been patched in release version 2.12.6."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-269: Improper Privilege Management"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498",
"refsource": "CONFIRM",
"url": "https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498"
},
{
"name": "https://github.com/bigbluebutton/greenlight/pull/3508",
"refsource": "MISC",
"url": "https://github.com/bigbluebutton/greenlight/pull/3508"
}
]
},
"source": {
"advisory": "GHSA-phh8-3v6v-7498",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-31039",
"datePublished": "2022-06-27T19:25:12.000Z",
"dateReserved": "2022-05-18T00:00:00.000Z",
"dateUpdated": "2025-04-23T18:07:57.100Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/bigbluebutton/greenlight/pull/3508\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T07:03:40.228Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-31039\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-23T14:04:40.869036Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-23T14:04:42.506Z\"}}], \"cna\": {\"title\": \"Improper privilege management - Anyone can view room settings in GreenLight\", \"source\": {\"advisory\": \"GHSA-phh8-3v6v-7498\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"bigbluebutton\", \"product\": \"greenlight\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 2.12.6\"}]}], \"references\": [{\"url\": \"https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/bigbluebutton/greenlight/pull/3508\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room\u0027s settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room\u0027s settings. This issue has been patched in release version 2.12.6.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269: Improper Privilege Management\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2022-06-27T19:25:12.000Z\"}, \"x_legacyV4Record\": {\"impact\": {\"cvss\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}, \"source\": {\"advisory\": \"GHSA-phh8-3v6v-7498\", \"discovery\": \"UNKNOWN\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"\u003c 2.12.6\"}]}, \"product_name\": \"greenlight\"}]}, \"vendor_name\": \"bigbluebutton\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498\", \"name\": \"https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498\", \"refsource\": \"CONFIRM\"}, {\"url\": \"https://github.com/bigbluebutton/greenlight/pull/3508\", \"name\": \"https://github.com/bigbluebutton/greenlight/pull/3508\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room\u0027s settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room\u0027s settings. This issue has been patched in release version 2.12.6.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"CWE-269: Improper Privilege Management\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2022-31039\", \"STATE\": \"PUBLIC\", \"TITLE\": \"Improper privilege management - Anyone can view room settings in GreenLight\", \"ASSIGNER\": \"security-advisories@github.com\"}}}}",
"cveMetadata": "{\"cveId\": \"CVE-2022-31039\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-23T18:07:57.100Z\", \"dateReserved\": \"2022-05-18T00:00:00.000Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2022-06-27T19:25:12.000Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…