6.8

CVE-2020-15215

Context isolation bypass in Electron

Electron before versions 11.0.0-beta.6, 10.1.2, 9.3.1 or 8.5.2 is vulnerable to a context isolation bypass. Apps using both `contextIsolation` and `sandbox: true` are affected. Apps using both `contextIsolation` and `nodeIntegrationInSubFrames: true` are affected. This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Electronjs ≫ Electron Version 8.0.0 Update -
Electronjs ≫ Electron Version 8.0.0 Update beta0
Electronjs ≫ Electron Version 8.0.0 Update beta1
Electronjs ≫ Electron Version 8.0.0 Update beta2
Electronjs ≫ Electron Version 8.0.0 Update beta3
Electronjs ≫ Electron Version 8.0.0 Update beta4
Electronjs ≫ Electron Version 8.0.0 Update beta5
Electronjs ≫ Electron Version 8.0.0 Update beta6
Electronjs ≫ Electron Version 8.0.0 Update beta7
Electronjs ≫ Electron Version 8.0.0 Update beta8
Electronjs ≫ Electron Version 8.0.0 Update beta9
Electronjs ≫ Electron Version 8.0.1 Update -
Electronjs ≫ Electron Version 8.0.2 Update -
Electronjs ≫ Electron Version 8.0.3 Update -
Electronjs ≫ Electron Version 8.1.0 Update -
Electronjs ≫ Electron Version 8.1.1 Update -
Electronjs ≫ Electron Version 8.2.0 Update -
Electronjs ≫ Electron Version 8.2.1 Update -
Electronjs ≫ Electron Version 8.2.2 Update -
Electronjs ≫ Electron Version 8.2.3 Update -
Electronjs ≫ Electron Version 8.2.4 Update -
Electronjs ≫ Electron Version 8.2.5 Update -
Electronjs ≫ Electron Version 8.3.0 Update -
Electronjs ≫ Electron Version 8.3.1 Update -
Electronjs ≫ Electron Version 8.3.2 Update -
Electronjs ≫ Electron Version 8.3.3 Update -
Electronjs ≫ Electron Version 8.3.4 Update -
Electronjs ≫ Electron Version 8.4.0 Update -
Electronjs ≫ Electron Version 8.4.1 Update -
Electronjs ≫ Electron Version 8.5.0 Update -
Electronjs ≫ Electron Version 8.5.1 Update -
Electronjs ≫ Electron Version 9.0.0 Update -
Electronjs ≫ Electron Version 9.0.0 Update beta0
Electronjs ≫ Electron Version 9.0.0 Update beta1
Electronjs ≫ Electron Version 9.0.0 Update beta10
Electronjs ≫ Electron Version 9.0.0 Update beta11
Electronjs ≫ Electron Version 9.0.0 Update beta12
Electronjs ≫ Electron Version 9.0.0 Update beta13
Electronjs ≫ Electron Version 9.0.0 Update beta14
Electronjs ≫ Electron Version 9.0.0 Update beta15
Electronjs ≫ Electron Version 9.0.0 Update beta16
Electronjs ≫ Electron Version 9.0.0 Update beta17
Electronjs ≫ Electron Version 9.0.0 Update beta18
Electronjs ≫ Electron Version 9.0.0 Update beta19
Electronjs ≫ Electron Version 9.0.0 Update beta2
Electronjs ≫ Electron Version 9.0.0 Update beta20
Electronjs ≫ Electron Version 9.0.0 Update beta3
Electronjs ≫ Electron Version 9.0.0 Update beta4
Electronjs ≫ Electron Version 9.0.0 Update beta5
Electronjs ≫ Electron Version 9.0.0 Update beta6
Electronjs ≫ Electron Version 9.0.0 Update beta7
Electronjs ≫ Electron Version 9.0.0 Update beta8
Electronjs ≫ Electron Version 9.0.0 Update beta9
Electronjs ≫ Electron Version 9.0.1 Update -
Electronjs ≫ Electron Version 9.0.2 Update -
Electronjs ≫ Electron Version 9.0.3 Update -
Electronjs ≫ Electron Version 9.0.4 Update -
Electronjs ≫ Electron Version 9.0.5 Update -
Electronjs ≫ Electron Version 9.0.6 Update -
Electronjs ≫ Electron Version 9.1.0 Update -
Electronjs ≫ Electron Version 9.1.1 Update -
Electronjs ≫ Electron Version 9.1.2 Update -
Electronjs ≫ Electron Version 9.2.0 Update -
Electronjs ≫ Electron Version 9.2.1 Update -
Electronjs ≫ Electron Version 9.3.0 Update -
Electronjs ≫ Electron Version 10.0.0 Update -
Electronjs ≫ Electron Version 10.0.0 Update beta1
Electronjs ≫ Electron Version 10.0.0 Update beta10
Electronjs ≫ Electron Version 10.0.0 Update beta11
Electronjs ≫ Electron Version 10.0.0 Update beta12
Electronjs ≫ Electron Version 10.0.0 Update beta13
Electronjs ≫ Electron Version 10.0.0 Update beta14
Electronjs ≫ Electron Version 10.0.0 Update beta15
Electronjs ≫ Electron Version 10.0.0 Update beta16
Electronjs ≫ Electron Version 10.0.0 Update beta17
Electronjs ≫ Electron Version 10.0.0 Update beta18
Electronjs ≫ Electron Version 10.0.0 Update beta19
Electronjs ≫ Electron Version 10.0.0 Update beta2
Electronjs ≫ Electron Version 10.0.0 Update beta20
Electronjs ≫ Electron Version 10.0.0 Update beta21
Electronjs ≫ Electron Version 10.0.0 Update beta22
Electronjs ≫ Electron Version 10.0.0 Update beta23
Electronjs ≫ Electron Version 10.0.0 Update beta24
Electronjs ≫ Electron Version 10.0.0 Update beta25
Electronjs ≫ Electron Version 10.0.0 Update beta3
Electronjs ≫ Electron Version 10.0.0 Update beta4
Electronjs ≫ Electron Version 10.0.0 Update beta5
Electronjs ≫ Electron Version 10.0.0 Update beta6
Electronjs ≫ Electron Version 10.0.0 Update beta7
Electronjs ≫ Electron Version 10.0.0 Update beta8
Electronjs ≫ Electron Version 10.0.0 Update beta9
Electronjs ≫ Electron Version 10.0.1 Update -
Electronjs ≫ Electron Version 10.1.0 Update -
Electronjs ≫ Electron Version 10.1.1 Update -
Electronjs ≫ Electron Version 11.0.0 Update beta0
Electronjs ≫ Electron Version 11.0.0 Update beta1
Electronjs ≫ Electron Version 11.0.0 Update beta2
Electronjs ≫ Electron Version 11.0.0 Update beta3
Electronjs ≫ Electron Version 11.0.0 Update beta4
Electronjs ≫ Electron Version 11.0.0 Update beta5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.479
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.6 2.2 3.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NIST 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
security-advisories@github.com 5.6 2.2 3.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

CWE-693 Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

https://github.com/electron/electron/security/advisories/GHSA-56pc-6jqp-xqj8
Third Party Advisory