Lucene search

GitHub_MCVE-2020-4076

HistoryJul 07, 2020 - 12:15 a.m.

CVE-2020-4076

2020-07-0700:15:10

CWE-501

GitHub_M

web.nvd.nist.gov

cve-2020-4076

electron

context isolation

security vulnerability

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:P/A:N

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

30.3%

JSON

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

Affected configurations

Nvd

Vulners

Node

electronjselectronRange7.0.0–7.2.4

electronjselectronRange8.0.0–8.2.4

electronjselectronMatch9.0.0-

electronjselectronMatch9.0.0beta1

electronjselectronMatch9.0.0beta10

electronjselectronMatch9.0.0beta11

electronjselectronMatch9.0.0beta12

electronjselectronMatch9.0.0beta13

electronjselectronMatch9.0.0beta14

electronjselectronMatch9.0.0beta15

electronjselectronMatch9.0.0beta16

electronjselectronMatch9.0.0beta17

electronjselectronMatch9.0.0beta18

electronjselectronMatch9.0.0beta19

electronjselectronMatch9.0.0beta2

electronjselectronMatch9.0.0beta20

electronjselectronMatch9.0.0beta3

electronjselectronMatch9.0.0beta4

electronjselectronMatch9.0.0beta5

electronjselectronMatch9.0.0beta6

electronjselectronMatch9.0.0beta7

electronjselectronMatch9.0.0beta8

electronjselectronMatch9.0.0beta9

VendorProductVersionCPE
electronjselectron*cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*

Vendor	Product	Version	CPE
electronjs	electron	*	cpe:2.3:a:electronjs:electron::::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:-::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta1::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta10::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta11::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta12::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta13::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta14::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta15::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta16::::::

Rows per page:

1-10 of 221

CNA Affected

[
  {
    "product": "electron",
    "vendor": "electron",
    "versions": [
      {
        "status": "affected",
        "version": ">= 9.0.0-beta.0, <= 9.0.0-beta.20"
      },
      {
        "status": "affected",
        "version": ">= 8.0.0, < 8.2.4"
      },
      {
        "status": "affected",
        "version": "< 7.2.4"
      }
    ]
  }
]

References

github.com/electron/electron/security/advisories/GHSA-m93v-9qjc-3g79

www.electronjs.org/releases/stable?page=3#release-notes-for-v824

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:P/A:N

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

30.3%

JSON

Related for CVE-2020-4076