CVE-2021-39215 — HIGH (7.5)

Vulnerability Description

Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that tokens generated by arbitrary sources can be used to gain authorization to protected rooms. This issue is fixed in Jitsi Meet 2.0.5963. There are no known workarounds aside from updating.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
8X8	Jitsi Meet	2.0.5963

Related Weaknesses (CWE)

CWE-287

References

https://github.com/jitsi/jitsi-meet/pull/9319PatchThird Party Advisory
https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfxThird Party Advisory
https://github.com/jitsi/jitsi-meet/pull/9319PatchThird Party Advisory
https://github.com/jitsi/jitsi-meet/security/advisories/GHSA-45ff-37jm-xjfxThird Party Advisory

FAQ

What is CVE-2021-39215?

CVE-2021-39215 is a vulnerability with a CVSS score of 7.5 (HIGH). Jitsi Meet is an open source video conferencing application. In versions prior to 2.0.5963, a Prosody module allows the use of symmetrical algorithms to validate JSON web tokens. This means that token...

How severe is CVE-2021-39215?

CVE-2021-39215 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-39215?

Check the references section above for vendor advisories and patch information. Affected products include: 8X8 Jitsi Meet.