CVE-2023-50975

2024-02-2100:00:00

mitre

github.com

td bank

advanced dashboard

macos

arbitrary code execution

electron run as node

AI Score

7.8

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsRunAsNodeEnabled (i.e., ELECTRON_RUN_AS_NODE can be used in production). This makes it easier for a compromised process to access banking information.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:tdbank:td-advanced-dashboard:*:*:*:*:*:*:*:*"
    ],
    "vendor": "tdbank",
    "product": "td-advanced-dashboard",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "3.0.3"
      }
    ],
    "defaultStatus": "affected"
  }
]