Search criteria
6 vulnerabilities found for jitsi-meet by jitsi
CVE-2025-64754 (GCVE-0-2025-64754)
Vulnerability from cvelistv5 – Published: 2025-11-13 21:48 – Updated: 2025-11-14 16:03
VLAI?
Title
Jitsi Meet has DOM Redirect on Microsoft OAuth Flow
Summary
Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.
Severity ?
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jitsi | jitsi-meet |
Affected:
< 2.0.10532
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-64754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-14T15:58:09.195945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-14T16:03:57.905Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jitsi-meet",
"vendor": "jitsi",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.10532"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.7,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-13T21:48:08.692Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78"
}
],
"source": {
"advisory": "GHSA-5fx7-wgcr-fj78",
"discovery": "UNKNOWN"
},
"title": "Jitsi Meet has DOM Redirect on Microsoft OAuth Flow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-64754",
"datePublished": "2025-11-13T21:48:08.692Z",
"dateReserved": "2025-11-10T22:29:34.874Z",
"dateUpdated": "2025-11-14T16:03:57.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-39215 (GCVE-0-2021-39215)
Vulnerability from cvelistv5 – Published: 2021-09-15 17:20 – Updated: 2024-08-04 01:58
VLAI?
Title
Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms
Summary
Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.
Severity ?
7.5 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jitsi | jitsi-meet |
Affected:
< 2.0.5963
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:58:18.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9319"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "jitsi-meet",
"vendor": "jitsi",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.5963"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-15T17:20:11",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9319"
}
],
"source": {
"advisory": "GHSA-45ff-37jm-xjfx",
"discovery": "UNKNOWN"
},
"title": "Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-39215",
"STATE": "PUBLIC",
"TITLE": "Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "jitsi-meet",
"version": {
"version_data": [
{
"version_value": "\u003c 2.0.5963"
}
]
}
}
]
},
"vendor_name": "jitsi"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287: Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx",
"refsource": "CONFIRM",
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx"
},
{
"name": "https://github.com/jitsi/jitsi-meet/pull/9319",
"refsource": "MISC",
"url": "https://github.com/jitsi/jitsi-meet/pull/9319"
}
]
},
"source": {
"advisory": "GHSA-45ff-37jm-xjfx",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-39215",
"datePublished": "2021-09-15T17:20:11",
"dateReserved": "2021-08-16T00:00:00",
"dateUpdated": "2024-08-04T01:58:18.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39205 (GCVE-0-2021-39205)
Vulnerability from cvelistv5 – Published: 2021-09-15 17:15 – Updated: 2024-08-04 01:58
VLAI?
Title
DOM-based XSS/Content Spoofing via Prototype Pollution
Summary
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
Severity ?
6.8 (Medium)
CWE
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jitsi | jitsi-meet |
Affected:
< 2.0.6173
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:58:18.260Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9320"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9404"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://hackerone.com/reports/1214493"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "jitsi-meet",
"vendor": "jitsi",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.6173"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-15T17:15:12",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9320"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9404"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/1214493"
}
],
"source": {
"advisory": "GHSA-6582-8v9q-v3fg",
"discovery": "UNKNOWN"
},
"title": "DOM-based XSS/Content Spoofing via Prototype Pollution",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-39205",
"STATE": "PUBLIC",
"TITLE": "DOM-based XSS/Content Spoofing via Prototype Pollution"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "jitsi-meet",
"version": {
"version_data": [
{
"version_value": "\u003c 2.0.6173"
}
]
}
}
]
},
"vendor_name": "jitsi"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg",
"refsource": "CONFIRM",
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"
},
{
"name": "https://github.com/jitsi/jitsi-meet/pull/9320",
"refsource": "MISC",
"url": "https://github.com/jitsi/jitsi-meet/pull/9320"
},
{
"name": "https://github.com/jitsi/jitsi-meet/pull/9404",
"refsource": "MISC",
"url": "https://github.com/jitsi/jitsi-meet/pull/9404"
},
{
"name": "https://hackerone.com/reports/1214493",
"refsource": "MISC",
"url": "https://hackerone.com/reports/1214493"
}
]
},
"source": {
"advisory": "GHSA-6582-8v9q-v3fg",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-39205",
"datePublished": "2021-09-15T17:15:12",
"dateReserved": "2021-08-16T00:00:00",
"dateUpdated": "2024-08-04T01:58:18.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-64754 (GCVE-0-2025-64754)
Vulnerability from nvd – Published: 2025-11-13 21:48 – Updated: 2025-11-14 16:03
VLAI?
Title
Jitsi Meet has DOM Redirect on Microsoft OAuth Flow
Summary
Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available.
Severity ?
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jitsi | jitsi-meet |
Affected:
< 2.0.10532
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-64754",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-14T15:58:09.195945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-14T16:03:57.905Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "jitsi-meet",
"vendor": "jitsi",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.10532"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authentication window for Microsoft accounts. This is fixed in version 2.0.10532. No known workarounds are available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.7,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-13T21:48:08.692Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-5fx7-wgcr-fj78"
}
],
"source": {
"advisory": "GHSA-5fx7-wgcr-fj78",
"discovery": "UNKNOWN"
},
"title": "Jitsi Meet has DOM Redirect on Microsoft OAuth Flow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-64754",
"datePublished": "2025-11-13T21:48:08.692Z",
"dateReserved": "2025-11-10T22:29:34.874Z",
"dateUpdated": "2025-11-14T16:03:57.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-39215 (GCVE-0-2021-39215)
Vulnerability from nvd – Published: 2021-09-15 17:20 – Updated: 2024-08-04 01:58
VLAI?
Title
Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms
Summary
Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.
Severity ?
7.5 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jitsi | jitsi-meet |
Affected:
< 2.0.5963
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:58:18.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9319"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "jitsi-meet",
"vendor": "jitsi",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.5963"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-15T17:20:11",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9319"
}
],
"source": {
"advisory": "GHSA-45ff-37jm-xjfx",
"discovery": "UNKNOWN"
},
"title": "Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-39215",
"STATE": "PUBLIC",
"TITLE": "Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "jitsi-meet",
"version": {
"version_data": [
{
"version_value": "\u003c 2.0.5963"
}
]
}
}
]
},
"vendor_name": "jitsi"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-287: Improper Authentication"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx",
"refsource": "CONFIRM",
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx"
},
{
"name": "https://github.com/jitsi/jitsi-meet/pull/9319",
"refsource": "MISC",
"url": "https://github.com/jitsi/jitsi-meet/pull/9319"
}
]
},
"source": {
"advisory": "GHSA-45ff-37jm-xjfx",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-39215",
"datePublished": "2021-09-15T17:20:11",
"dateReserved": "2021-08-16T00:00:00",
"dateUpdated": "2024-08-04T01:58:18.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-39205 (GCVE-0-2021-39205)
Vulnerability from nvd – Published: 2021-09-15 17:15 – Updated: 2024-08-04 01:58
VLAI?
Title
DOM-based XSS/Content Spoofing via Prototype Pollution
Summary
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
Severity ?
6.8 (Medium)
CWE
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| jitsi | jitsi-meet |
Affected:
< 2.0.6173
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T01:58:18.260Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9320"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9404"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://hackerone.com/reports/1214493"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "jitsi-meet",
"vendor": "jitsi",
"versions": [
{
"status": "affected",
"version": "\u003c 2.0.6173"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-09-15T17:15:12",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9320"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/jitsi/jitsi-meet/pull/9404"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://hackerone.com/reports/1214493"
}
],
"source": {
"advisory": "GHSA-6582-8v9q-v3fg",
"discovery": "UNKNOWN"
},
"title": "DOM-based XSS/Content Spoofing via Prototype Pollution",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2021-39205",
"STATE": "PUBLIC",
"TITLE": "DOM-based XSS/Content Spoofing via Prototype Pollution"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "jitsi-meet",
"version": {
"version_data": [
{
"version_value": "\u003c 2.0.6173"
}
]
}
}
]
},
"vendor_name": "jitsi"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg",
"refsource": "CONFIRM",
"url": "https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg"
},
{
"name": "https://github.com/jitsi/jitsi-meet/pull/9320",
"refsource": "MISC",
"url": "https://github.com/jitsi/jitsi-meet/pull/9320"
},
{
"name": "https://github.com/jitsi/jitsi-meet/pull/9404",
"refsource": "MISC",
"url": "https://github.com/jitsi/jitsi-meet/pull/9404"
},
{
"name": "https://hackerone.com/reports/1214493",
"refsource": "MISC",
"url": "https://hackerone.com/reports/1214493"
}
]
},
"source": {
"advisory": "GHSA-6582-8v9q-v3fg",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-39205",
"datePublished": "2021-09-15T17:15:12",
"dateReserved": "2021-08-16T00:00:00",
"dateUpdated": "2024-08-04T01:58:18.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}