Vulnerabilities > CVE-2022-31039 - Incorrect Authorization vulnerability in Bigbluebutton Greenlight

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

bigbluebutton

CWE-863

NVD

Published: 2022-06-27

Updated: 2022-07-07

Summary

Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in release version 2.12.6.

Vulnerable Configurations

Part	Description	Count
Application	Bigbluebutton Bigbluebutton Greenlight - Bigbluebutton Greenlight 2.0.0 Bigbluebutton Greenlight 2.0.1 Bigbluebutton Greenlight 2.0.2 Bigbluebutton Greenlight 2.0.3 Bigbluebutton Greenlight 2.0.4 Bigbluebutton Greenlight 2.0.5 Bigbluebutton Greenlight 2.0.6 Bigbluebutton Greenlight 2.0.7 Bigbluebutton Greenlight 2.0.8 Bigbluebutton Greenlight 2.0.9 Bigbluebutton Greenlight 2.1.0 Bigbluebutton Greenlight 2.1.1 Bigbluebutton Greenlight 2.1.2 Bigbluebutton Greenlight 2.1.3 Bigbluebutton Greenlight 2.2.0 Bigbluebutton Greenlight 2.2.1 Bigbluebutton Greenlight 2.2.2 Bigbluebutton Greenlight 2.2.3 Bigbluebutton Greenlight 2.2.4 Bigbluebutton Greenlight 2.3.0 Bigbluebutton Greenlight 2.3.1 Bigbluebutton Greenlight 2.3.2 Bigbluebutton Greenlight 2.3.3 Bigbluebutton Greenlight 2.3.4 Bigbluebutton Greenlight 2.4 Bigbluebutton Greenlight 2.4.1 Bigbluebutton Greenlight 2.4.2 Bigbluebutton Greenlight 2.5 Bigbluebutton Greenlight 2.5.1 Bigbluebutton Greenlight 2.5.2 Bigbluebutton Greenlight 2.5.3 Bigbluebutton Greenlight 2.5.4 Bigbluebutton Greenlight 2.5.5 Bigbluebutton Greenlight 2.5.6 Bigbluebutton Greenlight 2.6 Bigbluebutton Greenlight 2.6.1 Bigbluebutton Greenlight 2.6.2 Bigbluebutton Greenlight 2.6.3 Bigbluebutton Greenlight 2.6.4 Bigbluebutton Greenlight 2.6.5 Bigbluebutton Greenlight 2.7 Bigbluebutton Greenlight 2.7.1 Bigbluebutton Greenlight 2.7.2 Bigbluebutton Greenlight 2.7.3 Bigbluebutton Greenlight 2.7.4 Bigbluebutton Greenlight 2.7.5 Bigbluebutton Greenlight 2.7.6 Bigbluebutton Greenlight 2.7.7 Bigbluebutton Greenlight 2.7.8 Bigbluebutton Greenlight 2.7.9 Bigbluebutton Greenlight 2.7.10 Bigbluebutton Greenlight 2.7.11 Bigbluebutton Greenlight 2.7.12 Bigbluebutton Greenlight 2.7.13 Bigbluebutton Greenlight 2.7.14 Bigbluebutton Greenlight 2.7.15 Bigbluebutton Greenlight 2.7.15.1 Bigbluebutton Greenlight 2.7.16 Bigbluebutton Greenlight 2.7.17 Bigbluebutton Greenlight 2.7.18 Bigbluebutton Greenlight 2.7.19 Bigbluebutton Greenlight 2.7.20 Bigbluebutton Greenlight 2.8 Bigbluebutton Greenlight 2.8.1 Bigbluebutton Greenlight 2.8.2 Bigbluebutton Greenlight 2.8.2.1 Bigbluebutton Greenlight 2.8.2.2 Bigbluebutton Greenlight 2.8.3 Bigbluebutton Greenlight 2.8.4 Bigbluebutton Greenlight 2.8.5 Bigbluebutton Greenlight 2.8.6 Bigbluebutton Greenlight 2.8.7 Bigbluebutton Greenlight 2.9.0 Bigbluebutton Greenlight 2.9.1 Bigbluebutton Greenlight 2.9.2 Bigbluebutton Greenlight 2.10.0 Bigbluebutton Greenlight 2.10.0.1 Bigbluebutton Greenlight 2.10.0.2 Bigbluebutton Greenlight 2.10.0.3 Bigbluebutton Greenlight 2.11.0 Bigbluebutton Greenlight 2.11.1 Bigbluebutton Greenlight 2.11.2 Bigbluebutton Greenlight 2.12.0 Bigbluebutton Greenlight 2.12.1 Bigbluebutton Greenlight 2.12.1.1 Bigbluebutton Greenlight 2.12.2 Bigbluebutton Greenlight 2.12.2.1 Bigbluebutton Greenlight 2.12.3 Bigbluebutton Greenlight 2.12.4 Bigbluebutton Greenlight 2.12.5	97

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References