CVE-2022-31039

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even though they are not authorized to do so. Only the room owner and administrator should be able to view a room's settings. This issue has been patched in release version 2.12.6.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-269 CWE-863

Affected software

Vendor	Product	Versions
bigbluebutton	greenlight	< 2.12.6

References

https://github.com/bigbluebutton/greenlight/pull/3508Patch, Third Party Advisory
https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498Patch, Third Party Advisory
https://github.com/bigbluebutton/greenlight/pull/3508Patch, Third Party Advisory
https://github.com/bigbluebutton/greenlight/security/advisories/GHSA-phh8-3v6v-7498Patch, Third Party Advisory

Timeline

Published: Jun 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-31045.5An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return valu CVE-2022-310406.1Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open For CVE-2022-310416.5Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These CVE-2022-310427.5Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a reque CVE-2022-310437.5Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a re CVE-2022-310447.5Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism CVE-2022-310459.8Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain con CVE-2022-310464.3TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the ex CVE-2022-310476.5TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system CVE-2022-310485.4TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer b CVE-2022-310495.4TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used CVE-2022-31055.5An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_