CVE-2021-39205CWE-1321CWE-79

DOM-based XSS/Content Spoofing via Prototype Pollution

Medium · published September 15, 2021

CVSS v3.1
6.8
EPSS
1%
Percentile
68.6
In the wild
Unconfirmed
What it is

Jitsi Meet is an open source video conferencing application. Versions prior to 2.0.6173 are vulnerable to client-side cross-site scripting via injecting properties into JSON objects that were not properly escaped. There are no known incidents related to this vulnerability being exploited in the wild. This issue is fixed in Jitsi Meet version 2.0.6173. There are no known workarounds aside from upgrading.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01226 · 68.6th percentile
Weaknesses
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'); CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-09-15T17:15Z
EPSS history
Timeline
  • 15 SEP 17:15Z
    DOM-based XSS/Content Spoofing via Prototype Pollution
    cvelistv5