CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NCVE-2023-3434
Medium (5.4) in savoirfairelinux jami. EPSS 0.4% chance of exploitation in the next 30 days.
Improper Input Validation in the hyperlink interpretation in Savoir-faire Linux's Jami (version 20222284) on Windows.
This allows an attacker to send a custom HTML anchor tag to pass a string value to the Windows QRC Handler through the Jami messenger.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- savoirfairelinux:jami
References
- https://blog.blacklanternsecurity.com/p/Jami-Local-Denial-Of-Service-and-QRC-Handler-Vulnerabilities
- https://git.jami.net/savoirfairelinux/jami-client-qt/-/wikis/Changelog#nightly-january-10
- https://review.jami.net/c/jami-client-qt/+/23569
- https://blog.blacklanternsecurity.com/p/Jami-Local-Denial-Of-Service-and-QRC-Handler-Vulnerabilities
- https://git.jami.net/savoirfairelinux/jami-client-qt/-/wikis/Changelog#nightly-january-10