Critical severity · published Feb 9, 2023
CVE-2022-43550
A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert…
9.8
CVSS
1.8%
EPSS
No
On KEV
Description
A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JI
Jitsi · Jitsi
before 2022-09-14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43550
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43550
Patch
https://github.com/jitsi/jitsi/commit/8aa7be58522f4264078d54752aae5483bfd854b2
More from Jitsi
6.1
CVE-2022-36736
Jitsi-2.10.5550 was discovered to contain a vulnerability in its web UI which allows attackers to perform a clickjacking attack via a crafted HTTP request
5.9
CVE-2017-5603
An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable…