Lucene search

GitHub_MCVE-2020-4077

HistoryJul 07, 2020 - 12:15 a.m.

CVE-2020-4077

2020-07-0700:15:10

CWE-501

GitHub_M

web.nvd.nist.gov

electron

security

vulnerability

context isolation bypass

cve-2020-4077

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both contextIsolation and contextBridge are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

Affected configurations

Nvd

Vulners

Node

electronjselectronRange7.0.0–7.2.4

electronjselectronRange8.0.0–8.2.4

electronjselectronMatch9.0.0-

electronjselectronMatch9.0.0beta1

electronjselectronMatch9.0.0beta10

electronjselectronMatch9.0.0beta11

electronjselectronMatch9.0.0beta12

electronjselectronMatch9.0.0beta13

electronjselectronMatch9.0.0beta14

electronjselectronMatch9.0.0beta15

electronjselectronMatch9.0.0beta16

electronjselectronMatch9.0.0beta17

electronjselectronMatch9.0.0beta18

electronjselectronMatch9.0.0beta19

electronjselectronMatch9.0.0beta2

electronjselectronMatch9.0.0beta20

electronjselectronMatch9.0.0beta3

electronjselectronMatch9.0.0beta4

electronjselectronMatch9.0.0beta5

electronjselectronMatch9.0.0beta6

electronjselectronMatch9.0.0beta7

electronjselectronMatch9.0.0beta8

electronjselectronMatch9.0.0beta9

VendorProductVersionCPE
electronjselectron*cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*
electronjselectron9.0.0cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*

Vendor	Product	Version	CPE
electronjs	electron	*	cpe:2.3:a:electronjs:electron::::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:-::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta1::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta10::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta11::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta12::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta13::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta14::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta15::::::
electronjs	electron	9.0.0	cpe:2.3:a:electronjs:electron:9.0.0:beta16::::::

Rows per page:

1-10 of 221

CNA Affected

[
  {
    "product": "electron",
    "vendor": "electron",
    "versions": [
      {
        "status": "affected",
        "version": ">= 9.0.0-beta.0, <= 9.0.0-beta.20"
      },
      {
        "status": "affected",
        "version": ">= 8.0.0, < 8.2.4"
      },
      {
        "status": "affected",
        "version": "< 7.2.4"
      }
    ]
  }
]

References

github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g

www.electronjs.org/releases/stable?page=3#release-notes-for-v824

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

42.8%

JSON

Related for CVE-2020-4077