Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attacker due to the electron module (CVE-2022-29247, CVE-2022-36077)

Summary IBM App Connect Enterprise is vulnerable to a remote attacker due to the electron module CVE-2022-29247, CVE-2022-36077. Electron is used for Discovery Connectors in IBM App Connect Enterprise. The latest fixpack includes electron v21.2.0 Vulnerability Details CVEID:CVE-2022-36077...

@ultra-node/electron-engine (>=0.1.1, <=0.1.14) potentially affected by CVE-2022-36077 via electron (20.0.0)

electron NPM version 20.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on electron and may be impacted: - @ultra-node/electron-engine =0.1.1, =0.1.14 Source cves: CVE-2022-36077 Source advisory: OSV:GHSA-P2JH-44QJ-PF2V...

@ascua/electron (0.0.228), @jessezzhang/motion-core (>=0.0.1, <=0.0.5) +9 more potentially affected by CVE-2022-36077 via electron (>=18.0.0, <=18.3.2)

electron NPM version =18.0.0, =0.0.1, =0.0.21, =1.2.1, =2.0.72, =3.15.3, =0.0.0, =18.0.0, =1.0.0, =1.0.1 Source cves: CVE-2022-36077 Source advisory: OSV:GHSA-P2JH-44QJ-PF2V...

@cerebroapp/cerebro-basic-apps (>=1.0.0-alpha.0, <=1.0.0-alpha.1), @finsemble/finsemble-core (>=1.0.0-beta-3, <=8.0.2) +7 more potentially affected by CVE-2022-36077 via electron (>=19.0.0, <=19.0.10)

electron NPM version =19.0.0, =1.0.0-alpha.0, =1.0.0-beta-3, =1.0.0-beta-3, =3.0.9, =0.36.0-canary.17, =2.0.74, =2.0.83 - simple-git-gui 3.8.31 Source cves: CVE-2022-36077 Source advisory: OSV:GHSA-P2JH-44QJ-PF2V...

CVE-2022-36077

The CVE-2022-36077 vulnerability affects the Electron framework in versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11, and 18.3.7, where following redirects to file:// URLs can trigger Windows NTLM credential leakage via SMB targets. The issue is triggered when Electron delays a redirect check betw...