Critical severity · published Oct 29, 2024
CVE-2024-44081
In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message…
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
In Jitsi Meet before 2.0.9779, the functionality to share a video file was implemented in an insecure way, resulting in clients loading videos from an arbitrary URL if a message from another participant contains a URL encoded in the expected format.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JM
Jitsi Meet · 8x8
before 2.0.9779 · source: NVD
ME
Meet · Jitsi
before 2.0.9779 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-44081
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-44081
Patch
https://github.com/jitsi/jitsi-meet/compare/jitsi-meet_9672...jitsi-meet_9673
Third Party Advisory
https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2024-0003.md
More from Jitsi Meet
7.5
CVE-2024-44080
In Jitsi Meet before 2.0.9779, the functionality to share an image using giphy was implemented in an insecure way, resulting in clients loading GIFs from any arbitrary URL if a…
7.5
CVE-2021-39215
Jitsi Meet is an open source video conferencing application
7.5
CVE-2021-33506
jitsi-meet-prosody in Jitsi Meet before 2.0.5963-1 does not ensure that restrict_room_creation is set by default
6.1
CVE-2021-39205
Jitsi Meet is an open source video conferencing application