Medium severity · published Sep 15, 2021
CVE-2021-39205
Jitsi Meet is an open source video conferencing application
6.1
CVSS
1.2%
EPSS
No
On KEV
Description
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JM
Jitsi Meet · 8x8
before 2.0.6173 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-39205
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-39205
Patch
https://github.com/jitsi/jitsi-meet/pull/9320
Patch
https://github.com/jitsi/jitsi-meet/pull/9404
Third Party Advisory
https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg
Permissions Required
https://hackerone.com/reports/1214493
More from Jitsi Meet
9.8
CVE-2024-44081
In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message…
7.5
CVE-2024-44080
In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any arbitrary URL if a…
7.5
CVE-2021-39215
Jitsi Meet is an open source video conferencing application
7.5
CVE-2021-33506
jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default