7.5

CVE-2020-25019

Exploit
jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Jitsi ≫ Meet Electron Version < 2.3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.02% 0.59
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14
Patch
Third Party Advisory
https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0
Third Party Advisory
Release Notes
https://security.stackexchange.com/questions/225799
Third Party Advisory
Exploit
https://github.com/jitsi/jitsi-meet-electron/security/advisories/GHSA-x4h8-fhrp-pm3p
https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2020-0001.md