Description:

CVE-2024-33530 is a logic flaw in password-protected Jitsi Meet meetings that allows the disclosure of the meeting password to users invited to a call after waiting in the lobby. This vulnerability has a low CVSS score of 0, but its SVRS of 30 indicates a moderate level of risk.

Key Insights:

• Password Disclosure: This vulnerability allows attackers to obtain the password for password-protected Jitsi Meet meetings, potentially granting them access to sensitive information or disrupting ongoing meetings.
• Lobby Bypass: The flaw is triggered when a user is invited to a meeting after waiting in the lobby, bypassing the intended password protection mechanism.
• Active Exploitation: This vulnerability is actively exploited in the wild, making it a high-priority threat for organizations using Jitsi Meet.

Mitigation Strategies:

• Update Jitsi Meet: Install the latest version of Jitsi Meet (9391 or later) to patch the vulnerability.
• Disable Lobby: Consider disabling the lobby feature for password-protected meetings to prevent the exploitation of this vulnerability.
• Use Strong Passwords: Encourage users to use strong and unique passwords for Jitsi Meet meetings to minimize the impact of password disclosure.
• Monitor for Suspicious Activity: Regularly monitor Jitsi Meet logs and network traffic for any suspicious activity that may indicate exploitation attempts.

Additional Information:

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have been published for this vulnerability.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.