CVE-2021-39205
Summary
| CVE | CVE-2021-39205 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-09-15 18:15:00 UTC |
| Updated | 2022-09-10 02:45:00 UTC |
| Description | Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading. |
Risk And Classification
Problem Types: CWE-79 | CWE-1321
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | 8x8 | Jitsi Meet | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| DOM-based XSS/Content Spoofing via Prototype Pollution · Advisory · jitsi/jitsi-meet · GitHub | CONFIRM | github.com | |
| HackerOne | MISC | hackerone.com | |
| fix: Escapes some keys when parsing input. by damencho · Pull Request #9320 · jitsi/jitsi-meet · GitHub | MISC | github.com | |
| fix: Checks all parts while parsing config params. by damencho · Pull Request #9404 · jitsi/jitsi-meet · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 690194 Free Berkeley Software Distribution (FreeBSD) Security Update for couchdb (a7dd4c2d-77e4-46de-81a2-c453c317f9de)