PT-2020-12912 · 8X8 · Jitsi Meet

Published 2020-04-17 · Updated 2020-04-29 · CVE-2020-11878

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jitsi Meet (aka docker-jitsi-meet) versions prior to stable-4384-1

Description The issue concerns the use of default passwords for system accounts in the Jitsi Meet stack on Docker. Specifically, default passwords such as passw0rd are used. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

Recommendations For versions prior to stable-4384-1, update to stable-4384-1 or later to resolve the issue. As a temporary workaround, consider changing the default passwords for system accounts to unique, strong passwords until a patch is applied. Restrict access to system accounts to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-11878

Affected Products

Jitsi Meet

References · 5

• https://osv.dev/vulnerability/CVE-2020-11878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11878 · Security Note
• https://github.com/jitsi/docker-jitsi-meet/blob/master/CHANGELOG.md#stable-4384-1 · Note
• https://github.com/jitsi/docker-jitsi-meet/compare/stable-4384...stable-4384-1 · Note
• https://t.me/cvenotify/2892 · Telegram Post