CVE-2021-39215

Published: Sep 15, 2021Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.

Affected (1)

Products: 8x8: Jitsi Meet

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
8x8 Jitsi Meet	Version 2.0.5963

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://github.com/jitsi/jitsi-meet/pull/9319

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx

Source: security-advisories@github.com

Third Party Advisory

https://github.com/jitsi/jitsi-meet/pull/9319

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfx

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.