CVE-2020-4076

Published Jul 7, 2020

Last updated 4 years ago

Overview

Description
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass. Code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using contextIsolation are affected. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.
Source
security-advisories@github.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
9
Impact score
5.8
Exploitability score
2.5
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
3.6
Impact score
4.9
Exploitability score
3.9
Vector string
AV:L/AC:L/Au:N/C:P/I:P/A:N

Weaknesses

nvd@nist.gov
NVD-CWE-Other
security-advisories@github.com
CWE-501

Social media

Hype score
Not currently trending

Configurations