CVE-2021-39205

 

Published at: - 15-09-2021 08:15

Last modified: - 10-09-2022 04:45

Total changes: - 4

Description

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

 

Verification logic

 

Reference

• https://github.com/jitsi/jitsi-meet/pull/9320
• https://hackerone.com/reports/1214493
• https://github.com/jitsi/jitsi-meet/pull/9404
• https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg

 

Keywords

NVD

 

CVE-2021-39205

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures