CVE-2021-39205 DOM-based XSS/Content Spoofing via Prototype Pollution
Attackers can execute arbitrary scripts in Jitsi Meet via DOM-based XSS caused by prototype pollution, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-39205?
CVE-2021-39205 is a medium-severity cross-site scripting vulnerability in jitsi-meet, published on 15 Sep 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.
Which versions are affected by CVE-2021-39205?
It affects 1 product.
Products include 8x8 Jitsi Meet.
How do I fix CVE-2021-39205?
No fix has been published for CVE-2021-39205 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-39205 being exploited?
There is no known exploitation of CVE-2021-39205 in the wild and no public exploit code.