CVE-2020-25019

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0 calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14Patch, Third Party Advisory
https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0Release Notes, Third Party Advisory
https://github.com/jitsi/jitsi-meet-electron/security/advisories/GHSA-x4h8-fhrp-pm3p
https://github.com/jitsi/security-advisories/blob/master/advisories/JSA-2020-0001.md
https://security.stackexchange.com/questions/225799Exploit, Third Party Advisory
https://github.com/jitsi/jitsi-meet-electron/commit/ca1eb702507fdc4400fe21c905a9f85702f92a14Patch, Third Party Advisory
https://github.com/jitsi/jitsi-meet-electron/releases/tag/v2.3.0Release Notes, Third Party Advisory
https://security.stackexchange.com/questions/225799Exploit, Third Party Advisory

Timeline

Published: Aug 29, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-25026.1This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this v CVE-2020-250209.8MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components.CVE-2020-250219.8An issue was discovered in Noise-Java through 2020-08-27. ChaChaPolyCipherState.encryptWithAd() allows out-of-bounds access.CVE-2020-250229.8An issue was discovered in Noise-Java through 2020-08-27. AESGCMFallbackCipherState.encryptWithAd() allows out-of-bounds access.CVE-2020-250239.8An issue was discovered in Noise-Java through 2020-08-27. AESGCMOnCtrCipherState.encryptWithAd() allows out-of-bounds access.CVE-2020-250254.3The l10nmgr (aka Localization Manager) extension before 7.4.0, 8.x before 8.7.0, and 9.x before 9.2.0 for TYPO3 allows Information Disclosur CVE-2020-250264.3The sf_event_mgt (aka Event management and registration) extension before 4.3.1 and 5.x before 5.1.1 for TYPO3 allows Information Disclosure CVE-2020-25035.4If exploited, this stored cross-site scripting vulnerability could allow remote attackers to inject malicious code in File Station. QNAP has CVE-2020-250317.8checkinstall 1.6.2, when used to create a package that contains a symlink, may trigger the creation of a mode 0777 executable file.CVE-2020-250327.5An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private reso CVE-2020-250336.1The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.CVE-2020-250346.5eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort_by, sea