by Kastro
Paper/Archive/CVE-2022-43550

CVE-2022-43550

hackerone — A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windo…

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 78.4.784 × 2015.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution.

Affected

ProductAffectedFixed inSource
https://github.com/jitsiCommit: 8aa7be58522f4264078d54752aae5483bfd854b2–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/jitsi/jitsi/commit/8aa7be58522f4264078d54752aae5483bfd854b2