PT-2020-17866 · Electron · Electron

Marshallofsound · Published 2020-07-07 · Updated 2020-07-13 · CVE-2020-4077

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Electron versions prior to 7.2.4 Electron versions prior to 8.2.4 Electron versions prior to 9.0.0-beta21

Description The issue is a context isolation bypass, allowing code running in the main world context in the renderer to reach into the isolated Electron context and perform privileged actions. This affects apps using both contextIsolation and contextBridge.

Recommendations For versions prior to 7.2.4, update to version 7.2.4 or later. For versions prior to 8.2.4, update to version 8.2.4 or later. For versions prior to 9.0.0-beta21, update to version 9.0.0-beta21 or later.

Fix

Weakness Enumeration

CWE-501

Related Identifiers

CVE-2020-4077

GHSA-H9JC-284H-533G

Affected Products

Electron

References · 7

• https://electronjs.org/releases/stable?page=3#release-notes-for-v824 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h9jc-284h-533g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4077 · Security Note
• https://github.com/electron/electron/security/advisories/GHSA-h9jc-284h-533g · Note
• https://github.com/electron/electron/commit/b8e347709245d2dc5640fbb3044d9b21b4eaa6b0 · Note
• https://t.me/cvenotify/4892 · Telegram Post