PT-2024-8700 · 8X8 · Jitsi Meet

Mustafa Sanli · Published 2024-08-13 · Updated 2025-07-10 · CVE-2024-44081

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Jitsi Meet versions prior to 2.0.9779

Description The issue is related to the insecure implementation of the video file sharing functionality in Jitsi Meet. This allows a remote attacker to load arbitrary video files if a message from another participant contains a URL encoded in the expected format.

Recommendations For versions prior to 2.0.9779, update to version 2.0.9779 or later to resolve the issue. As a temporary workaround, consider restricting the use of the video file sharing feature until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-10302

CVE-2024-44081

Affected Products

Jitsi Meet

References · 7

• https://github.com/jitsi/jitsi-meet/compare/jitsi-meet_9672...jitsi-meet_9673 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-44081 · Security Note
• https://bdu.fstec.ru/vul/2024-10302 · Security Note
• https://osv.dev/vulnerability/CVE-2024-44081 · Vendor Advisory
• https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2024-0003.md · Note
• https://t.me/cvenotify/128426 · Telegram Post
• https://t.me/cvenotify/99972 · Telegram Post