6.5

CVE-2020-26272

Electron vulnerable to ID collision when routing IPC messages to renderers containing OOPIFs

The Electron framework lets users write cross-platform desktop applications using JavaScript, HTML and CSS. In versions of Electron IPC prior to 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9, messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no known workarounds for this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Electronjs ≫ Electron Version >= 9.0.0 < 9.4.0
Electronjs ≫ Electron Version >= 10.0.0 < 10.2.0
Electronjs ≫ Electron Version >= 11.0.0 < 11.1.0
Electronjs ≫ Electron Version 9.0.0 Update beta1
Electronjs ≫ Electron Version 9.0.0 Update beta10
Electronjs ≫ Electron Version 9.0.0 Update beta11
Electronjs ≫ Electron Version 9.0.0 Update beta12
Electronjs ≫ Electron Version 9.0.0 Update beta13
Electronjs ≫ Electron Version 9.0.0 Update beta14
Electronjs ≫ Electron Version 9.0.0 Update beta15
Electronjs ≫ Electron Version 9.0.0 Update beta16
Electronjs ≫ Electron Version 9.0.0 Update beta17
Electronjs ≫ Electron Version 9.0.0 Update beta18
Electronjs ≫ Electron Version 9.0.0 Update beta19
Electronjs ≫ Electron Version 9.0.0 Update beta2
Electronjs ≫ Electron Version 9.0.0 Update beta20
Electronjs ≫ Electron Version 9.0.0 Update beta21
Electronjs ≫ Electron Version 9.0.0 Update beta22
Electronjs ≫ Electron Version 9.0.0 Update beta23
Electronjs ≫ Electron Version 9.0.0 Update beta24
Electronjs ≫ Electron Version 9.0.0 Update beta3
Electronjs ≫ Electron Version 9.0.0 Update beta4
Electronjs ≫ Electron Version 9.0.0 Update beta5
Electronjs ≫ Electron Version 9.0.0 Update beta6
Electronjs ≫ Electron Version 9.0.0 Update beta7
Electronjs ≫ Electron Version 9.0.0 Update beta8
Electronjs ≫ Electron Version 9.0.0 Update beta9
Electronjs ≫ Electron Version 10.0.0 Update beta1
Electronjs ≫ Electron Version 10.0.0 Update beta10
Electronjs ≫ Electron Version 10.0.0 Update beta11
Electronjs ≫ Electron Version 10.0.0 Update beta12
Electronjs ≫ Electron Version 10.0.0 Update beta13
Electronjs ≫ Electron Version 10.0.0 Update beta14
Electronjs ≫ Electron Version 10.0.0 Update beta15
Electronjs ≫ Electron Version 10.0.0 Update beta17
Electronjs ≫ Electron Version 10.0.0 Update beta19
Electronjs ≫ Electron Version 10.0.0 Update beta2
Electronjs ≫ Electron Version 10.0.0 Update beta20
Electronjs ≫ Electron Version 10.0.0 Update beta21
Electronjs ≫ Electron Version 10.0.0 Update beta23
Electronjs ≫ Electron Version 10.0.0 Update beta24
Electronjs ≫ Electron Version 10.0.0 Update beta25
Electronjs ≫ Electron Version 10.0.0 Update beta3
Electronjs ≫ Electron Version 10.0.0 Update beta4
Electronjs ≫ Electron Version 10.0.0 Update beta5
Electronjs ≫ Electron Version 10.0.0 Update beta6
Electronjs ≫ Electron Version 10.0.0 Update beta7
Electronjs ≫ Electron Version 10.0.0 Update beta8
Electronjs ≫ Electron Version 10.0.0 Update beta9
Electronjs ≫ Electron Version 11.0.0 Update beta1
Electronjs ≫ Electron Version 11.0.0 Update beta10
Electronjs ≫ Electron Version 11.0.0 Update beta11
Electronjs ≫ Electron Version 11.0.0 Update beta12
Electronjs ≫ Electron Version 11.0.0 Update beta13
Electronjs ≫ Electron Version 11.0.0 Update beta14
Electronjs ≫ Electron Version 11.0.0 Update beta15
Electronjs ≫ Electron Version 11.0.0 Update beta16
Electronjs ≫ Electron Version 11.0.0 Update beta17
Electronjs ≫ Electron Version 11.0.0 Update beta18
Electronjs ≫ Electron Version 11.0.0 Update beta19
Electronjs ≫ Electron Version 11.0.0 Update beta20
Electronjs ≫ Electron Version 11.0.0 Update beta21
Electronjs ≫ Electron Version 11.0.0 Update beta22
Electronjs ≫ Electron Version 11.0.0 Update beta23
Electronjs ≫ Electron Version 11.0.0 Update beta3
Electronjs ≫ Electron Version 11.0.0 Update beta4
Electronjs ≫ Electron Version 11.0.0 Update beta5
Electronjs ≫ Electron Version 11.0.0 Update beta6
Electronjs ≫ Electron Version 11.0.0 Update beta7
Electronjs ≫ Electron Version 11.0.0 Update beta8
Electronjs ≫ Electron Version 11.0.0 Update beta9
Electronjs ≫ Electron Version 12.0.0 Update beta1
Electronjs ≫ Electron Version 12.0.0 Update beta3
Electronjs ≫ Electron Version 12.0.0 Update beta4
Electronjs ≫ Electron Version 12.0.0 Update beta5
Electronjs ≫ Electron Version 12.0.0 Update beta6
Electronjs ≫ Electron Version 12.0.0 Update beta7
Electronjs ≫ Electron Version 12.0.0 Update beta8
Electronjs ≫ Electron Version 12.0.0 Update beta9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.73% 0.748
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NIST 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
security-advisories@github.com 5.4 2.2 2.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

https://github.com/electron/electron/commit/07a1c2a3e5845901f7e2eda9506695be58edc73c
Patch
Third Party Advisory
https://github.com/electron/electron/pull/26875
Third Party Advisory
https://github.com/electron/electron/releases/tag/v9.4.0
Third Party Advisory
Release Notes
https://github.com/electron/electron/security/advisories/GHSA-hvf8-h2qh-37m9
Third Party Advisory
https://www.electronjs.org/releases/stable?version=9#9.4.0
Vendor Advisory
Release Notes
https://github.com/electron/electron/commit/0bbd268eb4caf35604443df5ff196980dd49e208
https://github.com/electron/electron/commit/36c695ce2a7e22c07fe1e30c61c00d20371daee2
https://github.com/electron/electron/commit/429400040ecb16a21d19936658579e65a797e4cc
https://github.com/electron/electron/commit/5c8e7e8b7f485ceafa8b271086d7b87e1de9dedd