Vulnerability · Published Feb 9, 2023 · Assigned by hackerone
CVE-2022-43550
Critical 9.8
In plain English
A critical-severity OS command injection in https://github.com/jitsi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.8%top 21.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/jitsi | Commit: 8aa7be58522f4264078d54752aae5483bfd854b2 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H