CVE-2021-39205mediumCWE-1321CWE-79

CVE-2021-39205: falha de média gravidade em jitsi-meet

DOM-based XSS/Content Spoofing via Prototype Pollution

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar jitsi-meet

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 1.2%
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
jitsi · jitsi-meet
CVEs relacionadas — jitsi-meet

No mesmo produto, das mais perigosas para as menos.

CVE-2021-39215HIGHAuthentication Bypass: Forged Tokens Allow Access to Arbitrary RoomsEPSS 1.2%CVE-2025-64754LOWJitsi Meet has DOM Redirect on Microsoft OAuth FlowEPSS 0.4%