8.1

CVE-2018-1000136

Exploit
Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Electronjs ≫ Electron Version >= 1.7.0 <= 1.7.12
Electronjs ≫ Electron Version > 1.8.0 <= 1.8.3
Electronjs ≫ Electron Version2.0.0
Electronjs ≫ Electron Version2.0.0 Updatebeta1
Electronjs ≫ Electron Version2.0.0 Updatebeta2
Electronjs ≫ Electron Version2.0.0 Updatebeta3
Electronjs ≫ Electron Version2.0.0 Updatebeta4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.41% 0.802
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.2 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://www.electronjs.org/blog/webview-fix
Patch
Vendor Advisory
Mitigation