CVE-2020-25019

Опубликовано: 29 авг. 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 4.3

EPSS Низкий

Описание

jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

Ссылки

https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14
Patch
Third Party Advisory
https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0
Release Notes
Third Party Advisory
https://github.com/jitsi/jitsi-meet-electron/security/advisories/GHSA-x4h8-fhrp-pm3p
https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2020-0001.md
https://security.stackexchange.com/questions/225799
Exploit
Third Party Advisory
https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14
Patch
Third Party Advisory
https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0
Release Notes
Third Party Advisory
https://security.stackexchange.com/questions/225799
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jitsi:meet_electron:*:*:*:*:*:*:*:*

Версия до 2.3.0 (исключая)

EPSS

Процентиль: 35%

0.00145

Низкий

7.5 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-345

Связанные уязвимости

GHSA-gqh9-f35v-5g5x

CVSS3: 7.5

github

больше 3 лет назад

jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

BDU:2025-14719

CVSS3: 7.5

fstec

больше 5 лет назад

Уязвимость программного обеспечения для видеоконференций Jitsi Meet Electron, связанная с недостаточной проверкой подлинности данных, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 35%

0.00145

Низкий

7.5 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-345