high7.5
CVE-2020-25019
jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or http…
Impact
jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jitsi | Meet Electron | before 2.3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14
- https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0
- https://github.com/jitsi/jitsi-meet-electron/security/advisories/GHSA-x4h8-fhrp-pm3p
- https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2020-0001.md
- https://security.stackexchange.com/questions/225799
- https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14
- https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0
- https://security.stackexchange.com/questions/225799