Lucene search

GitHub_MCVE-2020-15174

HistoryOct 06, 2020 - 6:15 p.m.

CVE-2020-15174

2020-10-0618:15:14

CWE-693

CWE-20

GitHub_M

web.nvd.nist.gov

cve

electron

security

patch

bypass

navigation

sandbox

attribute

nvd

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

49.3%

JSON

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the will-navigate event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.

Affected configurations

Nvd

Vulners

Node

electronjselectronRange8.0.0–8.5.1

electronjselectronRange9.0.0–9.3.0

electronjselectronRange10.0.0–10.0.1

VendorProductVersionCPE
electronjselectron*cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
electronjs	electron	*	cpe:2.3:a:electronjs:electron::::::::

CNA Affected

[
  {
    "product": "electron",
    "vendor": "electron",
    "versions": [
      {
        "status": "affected",
        "version": ">= 8.0.0-beta.0, < 8.5.1"
      },
      {
        "status": "affected",
        "version": ">= 9.0.0-beta.0, < 9.3.0"
      },
      {
        "status": "affected",
        "version": ">= 10.0.0-beta.0, < 10.0.1"
      }
    ]
  }
]

References

github.com/electron/electron/commit/18613925610ba319da7f497b6deed85ad712c59b

github.com/electron/electron/security/advisories/GHSA-2q4g-w47c-4674

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L

AI Score

7.4

Confidence

High

EPSS

0.001

Percentile

49.3%

JSON

Related for CVE-2020-15174