9.9
CVE-2020-4077
- EPSS 0.44%
- Veröffentlicht 07.07.2020 00:15:10
- Zuletzt bearbeitet 21.11.2024 05:32:15
- Quelle security-advisories@github.com
- CVE-Watchlists
- Unerledigt
LoginIn Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using both `contextIsolation` and `contextBridge` are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Electronjs ≫ Electron Version >= 7.0.0 < 7.2.4
Electronjs ≫ Electron Version >= 8.0.0 < 8.2.4
Electronjs ≫ Electron Version9.0.0 Update-
Electronjs ≫ Electron Version9.0.0 Updatebeta1
Electronjs ≫ Electron Version9.0.0 Updatebeta10
Electronjs ≫ Electron Version9.0.0 Updatebeta11
Electronjs ≫ Electron Version9.0.0 Updatebeta12
Electronjs ≫ Electron Version9.0.0 Updatebeta13
Electronjs ≫ Electron Version9.0.0 Updatebeta14
Electronjs ≫ Electron Version9.0.0 Updatebeta15
Electronjs ≫ Electron Version9.0.0 Updatebeta16
Electronjs ≫ Electron Version9.0.0 Updatebeta17
Electronjs ≫ Electron Version9.0.0 Updatebeta18
Electronjs ≫ Electron Version9.0.0 Updatebeta19
Electronjs ≫ Electron Version9.0.0 Updatebeta2
Electronjs ≫ Electron Version9.0.0 Updatebeta20
Electronjs ≫ Electron Version9.0.0 Updatebeta3
Electronjs ≫ Electron Version9.0.0 Updatebeta4
Electronjs ≫ Electron Version9.0.0 Updatebeta5
Electronjs ≫ Electron Version9.0.0 Updatebeta6
Electronjs ≫ Electron Version9.0.0 Updatebeta7
Electronjs ≫ Electron Version9.0.0 Updatebeta8
Electronjs ≫ Electron Version9.0.0 Updatebeta9
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.44% | 0.6 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 9.9 | 3.1 | 6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
|
| nvd@nist.gov | 6.5 | 8 | 6.4 |
AV:N/AC:L/Au:S/C:P/I:P/A:P
|
| security-advisories@github.com | 7.7 | 3.1 | 4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
|
CWE-501 Trust Boundary Violation
The product mixes trusted and untrusted data in the same data structure or structured message.