6.8

CVE-2020-15096

Context isolation bypass via Promise in Electron

In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affected. There are no app-side workarounds, you must update your Electron version to be protected. This is fixed in versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Electronjs ≫ Electron Version < 6.1.1
Electronjs ≫ Electron Version >= 7.0.0 < 7.2.4
Electronjs ≫ Electron Version >= 8.0.0 < 8.2.4
Electronjs ≫ Electron Version 9.0.0 Update -
Electronjs ≫ Electron Version 9.0.0 Update beta1
Electronjs ≫ Electron Version 9.0.0 Update beta10
Electronjs ≫ Electron Version 9.0.0 Update beta11
Electronjs ≫ Electron Version 9.0.0 Update beta12
Electronjs ≫ Electron Version 9.0.0 Update beta13
Electronjs ≫ Electron Version 9.0.0 Update beta14
Electronjs ≫ Electron Version 9.0.0 Update beta15
Electronjs ≫ Electron Version 9.0.0 Update beta16
Electronjs ≫ Electron Version 9.0.0 Update beta17
Electronjs ≫ Electron Version 9.0.0 Update beta18
Electronjs ≫ Electron Version 9.0.0 Update beta19
Electronjs ≫ Electron Version 9.0.0 Update beta2
Electronjs ≫ Electron Version 9.0.0 Update beta20
Electronjs ≫ Electron Version 9.0.0 Update beta3
Electronjs ≫ Electron Version 9.0.0 Update beta4
Electronjs ≫ Electron Version 9.0.0 Update beta5
Electronjs ≫ Electron Version 9.0.0 Update beta6
Electronjs ≫ Electron Version 9.0.0 Update beta7
Electronjs ≫ Electron Version 9.0.0 Update beta8
Electronjs ≫ Electron Version 9.0.0 Update beta9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.81% 0.521
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.8 2.3 4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
security-advisories@github.com 6.8 2.3 4
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
CWE-501 Trust Boundary Violation

The product mixes trusted and untrusted data in the same data structure or structured message.

https://github.com/electron/electron/security/advisories/GHSA-6vrv-94jv-crrg
Third Party Advisory
https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824
Vendor Advisory
Release Notes