PT-2022-15061 · Electron · Electron

Marshallofsound

·

Published

2022-03-22

·

Updated

2023-07-24

·

CVE-2022-21718

CVSS v2.0

4.0

Medium

VectorAV:N/AC:L/Au:S/C:P/I:N/A:N
Name of the Vulnerable Software and Affected Versions Electron versions prior to 17.0.0-alpha.6 Electron versions prior to 16.0.6 Electron versions prior to 15.3.5 Electron versions prior to 14.2.4 Electron versions prior to 13.6.6
Description A vulnerability in Electron allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom select-bluetooth-device event handler. The device that is accessed is random and the attacker would have no way of selecting a specific device. All current stable versions of Electron are affected.
Recommendations For versions prior to 17.0.0-alpha.6, update to version 17.0.0-alpha.6 or later. For versions prior to 16.0.6, update to version 16.0.6 or later. For versions prior to 15.3.5, update to version 15.3.5 or later. For versions prior to 14.2.4, update to version 14.2.4 or later. For versions prior to 13.6.6, update to version 13.6.6 or later. As a temporary workaround, consider adding the code to prevent default behavior and cancel the request for the select-bluetooth-device event handler.

Exploit

Fix

Missing Authorization

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-862CWE-668

Related Identifiers

CVE-2022-21718
GHSA-3P22-GHQ8-V749

Affected Products

Electron