Vulnerability · Published Sep 15, 2021 · Assigned by GitHub_M

CVE-2021-39205DOM-based XSS/Content Spoofing via Prototype Pollution

Medium 6.8

In plain English

A medium-severity cross-site scripting in jitsi-meet from jitsi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)1.2%top 31.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.

Affected products (as reported)

Vendor	Product	Versions
jitsi	jitsi-meet	< 2.0.6173

Weakness: CWE-79, CWE-1321 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-6582-8v9q-v3fg x_refsource_CONFIRM
https://github.com/jitsi/jitsi-meet/pull/9320 x_refsource_MISC
https://github.com/jitsi/jitsi-meet/pull/9404 x_refsource_MISC
https://hackerone.com/reports/1214493 x_refsource_MISC