Lucene search

MitreCVE-2018-15685

HistoryAug 23, 2018 - 5:29 a.m.

CVE-2018-15685

2018-08-2305:29:00

CWE-1188

mitre

web.nvd.nist.gov

github

electron

cve-2018-15685

webpreferences

vulnerability

remote code execution

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.024

Percentile

89.9%

JSON

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and “nativeWindowOpen: true” or “sandbox: true” options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

Affected configurations

Nvd

Node

electronjselectronMatch1.7.15

electronjselectronMatch1.8.7

electronjselectronMatch2.0.7

electronjselectronMatch3.0.0beta6

VendorProductVersionCPE
electronjselectron1.7.15cpe:2.3:a:electronjs:electron:1.7.15:*:*:*:*:*:*:*
electronjselectron1.8.7cpe:2.3:a:electronjs:electron:1.8.7:*:*:*:*:*:*:*
electronjselectron2.0.7cpe:2.3:a:electronjs:electron:2.0.7:*:*:*:*:*:*:*
electronjselectron3.0.0cpe:2.3:a:electronjs:electron:3.0.0:beta6:*:*:*:*:*:*

Vendor	Product	Version	CPE
electronjs	electron	1.7.15	cpe:2.3:a:electronjs:electron:1.7.15:::::::*
electronjs	electron	1.8.7	cpe:2.3:a:electronjs:electron:1.8.7:::::::*
electronjs	electron	2.0.7	cpe:2.3:a:electronjs:electron:2.0.7:::::::*
electronjs	electron	3.0.0	cpe:2.3:a:electronjs:electron:3.0.0:beta6::::::