PT-2018-6178 · Electron+1 · Electronjs+1

Publicado 2018-06-07 · Atualizado 2019-10-09 · CVE-2017-16151

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ElectronJS versions prior to 1.7.8

Description: A remote code execution issue has been discovered in Google Chromium, affecting recent versions of Electron. This issue occurs when an Electron application accesses remote content, regardless of whether the sandbox option is enabled.

Recommendations: Update to Electron version 1.7.8 or later.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-16151

GHSA-4W88-RJJ3-X7WP

Produtos afetados

Electronjs

Google Chromium

Referências · 8

• https://nodesecurity.io/advisories/539 · Nota
• https://electronjs.org/blog/chromium-rce-vulnerability · Nota
• https://osv.dev/vulnerability/GHSA-4w88-rjj3-x7wp · Aviso do Fabricante
• https://github.com/advisories/GHSA-4w88-rjj3-x7wp · Nota
• https://npmjs.com/advisories/539 · Nota
• https://electron.atom.io/blog/2017/09/27/chromium-rce-vulnerability-fix · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-16151 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16151 · Aviso do Fabricante