CVE-2021-39215
Authentication Bypass: Forged Tokens Allow Access to Arbitrary Rooms
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.5EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
15 sep 2021Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
jitsi · jitsi-meet¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →