PT-2024-7557 · Unknown · Jitsi Meet

Mustafa Sanli · Published 2024-08-09 · Updated 2025-07-10 · CVE-2024-44080

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Jitsi Meet versions prior to 2.0.9779

Description The issue is related to the insecure implementation of the image sharing functionality using giphy in Jitsi Meet. This allows clients to load GIFs from any arbitrary URL if a message from another participant contains a URL encoded in the expected format. The vulnerability can be exploited by a remote attacker to load arbitrary GIF files.

Recommendations For versions prior to 2.0.9779, update to version 2.0.9779 or later to resolve the issue. As a temporary workaround, consider disabling the giphy image sharing functionality until a patch is available. Restrict access to the giphy feature to minimize the risk of exploitation. Avoid using the giphy feature in Jitsi Meet until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-08955

CVE-2024-44080

Affected Products

Jitsi Meet

References · 8

• https://bdu.fstec.ru/vul/2024-08955 · Security Note
• https://osv.dev/vulnerability/CVE-2024-44080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44080 · Security Note
• https://github.com/jitsi/jitsi-meet/compare/jitsi-meet_9672...jitsi-meet_9673 · Note
• https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2024-0002.md · Note
• https://t.me/cvenotify/128425 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-44080 · Note
• https://t.me/cvenotify/99971 · Telegram Post