Insecure Video Sharing in Jitsi Meet Could Lead to File Inclusion Attacks
CVE-2024-44081

9.8CRITICAL

Key Information:

Vendor

Jitsi

Status
Jitsi Meet
Vendor
CVE Published:
29 October 2024

What is CVE-2024-44081?

A vulnerability exists in Jitsi Meet prior to version 2.0.9779, where the implementation of video file sharing allows clients to load video files from arbitrary URLs. When a user receives a message containing a URL formatted correctly, it can be invoked without proper validation, leading to potential exposure of sensitive information or unauthorized access to external resources. This issue underscores the importance of securing data handling protocols in collaborative applications.

References

https://github.com/jitsi/jitsi-meet/compare/jitsi-meet_96...
https://github.com/jitsi/security-advisories/blob/master/...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.