CVE-2020-25019
HIGHCVSS 7.5/10EPSS 1.02%
Last modified
CVE-2020-25019 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.. EPSS estimates a 1.02% chance of exploitation in the next 30 days.
Description
jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jitsi | Meet Electron | < 2.3.0 |
References
- https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14Patch, Third Party Advisory
- https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0Release Notes, Third Party Advisory
- https://security.stackexchange.com/questions/225799Exploit, Third Party Advisory
- https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14Patch, Third Party Advisory
- https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0Release Notes, Third Party Advisory
- https://security.stackexchange.com/questions/225799Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-25019?
jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.
How severe is CVE-2020-25019?
CVE-2020-25019 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.02% probability of exploitation in the next 30 days.
How do I fix CVE-2020-25019?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-25013JetBrains ToolBox before version 1.18 is vulnerable to a Den…7.5
- CVE-2020-25014A stack-based buffer overflow in fbwifi_continue.cgi on Zyxe…9.8
- CVE-2020-25015A specific router allows changing the Wi-Fi password remotel…6.5
- CVE-2020-25016A safety violation was discovered in the rgb crate before 0.…9.1
- CVE-2020-25017Envoy through 1.15.0 only considers the first value when mul…8.3
- CVE-2020-25018Envoy master between 2d69e30 and 3b5acb2 may fail to parse r…7.5
- CVE-2020-2502This cross-site scripting vulnerability in Photo Station all…6.1
- CVE-2020-25020MPXJ through 8.1.3 allows XXE attacks. This affects the Gant…9.8
- CVE-2020-25021An issue was discovered in Noise-Java through 2020-08-27. Ch…9.8
- CVE-2020-25022An issue was discovered in Noise-Java through 2020-08-27. AE…9.8
- CVE-2020-25023An issue was discovered in Noise-Java through 2020-08-27. AE…9.8
- CVE-2020-25025The l10nmgr (aka Localization Manager) extension before 7.4.…4.3
Are you affected by CVE-2020-25019?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST