CVE-2022-29247 - Vulnerability Details

Vendors	Products
Electronjs	Electron

Link	Providers
https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "electron", "vendor": "electron", "versions": [{"status": "affected", "version": "< 15.5.5"}, {"status": "affected", "version": ">= 16.0.0-beta.1, < 16.2.6"}, {"status": "affected", "version": ">= 17.0.0-beta.1, < 17.2.0"}, {"status": "affected", "version": ">= 18.0.0-beta.1, <= 18.0.0-beta.5"}]}], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-668", "description": "CWE-668: Exposure of Resource to Wrong Sphere", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-13T21:05:10", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7"}], "source": {"advisory": "GHSA-mq8j-3h7h-p8g7", "discovery": "UNKNOWN"}, "title": "Exposure of Resource to Wrong Sphere in Electron", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-29247", "STATE": "PUBLIC", "TITLE": "Exposure of Resource to Wrong Sphere in Electron"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "electron", "version": {"version_data": [{"version_value": "< 15.5.5"}, {"version_value": ">= 16.0.0-beta.1, < 16.2.6"}, {"version_value": ">= 17.0.0-beta.1, < 17.2.0"}, {"version_value": ">= 18.0.0-beta.1, <= 18.0.0-beta.5"}]}}]}, "vendor_name": "electron"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-668: Exposure of Resource to Wrong Sphere"}]}]}, "references": {"reference_data": [{"name": "https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7", "refsource": "CONFIRM", "url": "https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7"}]}, "source": {"advisory": "GHSA-mq8j-3h7h-p8g7", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:17:54.477Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-29247", "datePublished": "2022-06-13T21:05:10", "dateReserved": "2022-04-13T00:00:00", "dateUpdated": "2024-08-03T06:17:54.477Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : electron (string)

vendor : electron (string)

versions : [ »

0 : { »

status : affected (string)

version : < 15.5.5 (string)

}

1 : { »

status : affected (string)

version : >= 16.0.0-beta.1, < 16.2.6 (string)

}

2 : { »

status : affected (string)

version : >= 17.0.0-beta.1, < 17.2.0 (string)

}

3 : { »

status : affected (string)

version : >= 18.0.0-beta.1, <= 18.0.0-beta.5 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 2.2 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-668 (string)

description : CWE-668: Exposure of Resource to Wrong Sphere (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2022-06-13T21:05:10 (string)

orgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

shortName : GitHub_M (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7 (string)

}

]

source : { »

advisory : GHSA-mq8j-3h7h-p8g7 (string)

discovery : UNKNOWN (string)

}

title : Exposure of Resource to Wrong Sphere in Electron (string)

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : security-advisories@github.com (string)

ID : CVE-2022-29247 (string)

STATE : PUBLIC (string)

TITLE : Exposure of Resource to Wrong Sphere in Electron (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : electron (string)

version : { »

version_data : [ »

0 : { »

version_value : < 15.5.5 (string)

}

1 : { »

version_value : >= 16.0.0-beta.1, < 16.2.6 (string)

}

2 : { »

version_value : >= 17.0.0-beta.1, < 17.2.0 (string)

}

3 : { »

version_value : >= 18.0.0-beta.1, <= 18.0.0-beta.5 (string)

}

]

}

]

}

vendor_name : electron (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`. (string)

}

]

}

impact : { »

cvss : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 2.2 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : CWE-668: Exposure of Resource to Wrong Sphere (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7 (string)

refsource : CONFIRM (string)

url : https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7 (string)

}

]

}

source : { »

advisory : GHSA-mq8j-3h7h-p8g7 (string)

discovery : UNKNOWN (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T06:17:54.477Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : a0819718-46f1-4df5-94e2-005712e83aaa (string)

assignerShortName : GitHub_M (string)

cveId : CVE-2022-29247 (string)

datePublished : 2022-06-13T21:05:10 (string)

dateReserved : 2022-04-13T00:00:00 (string)

dateUpdated : 2024-08-03T06:17:54.477Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*", "matchCriteriaId": "62A3846F-57BE-4ABE-A656-CA28FD62BA62", "versionEndExcluding": "15.5.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA3F2F40-BD84-4541-B5B3-5DC5DC3AEC24", "versionEndExcluding": "16.2.6", "versionStartIncluding": "16.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*", "matchCriteriaId": "2B4978EA-362E-46C8-A56B-4F4B47237C05", "versionEndExcluding": "17.2.0", "versionStartIncluding": "17.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:16.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "DCBD6783-12BE-4D63-B403-188943FB4F02", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:16.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "989D1505-66D5-4855-A8FA-58F9566FF7FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:16.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "E6C15DE2-CA55-4A42-8D64-C44068B24B93", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:16.0.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "2A4E764B-39E3-4C93-8F7F-1ACFA66FA51B", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:16.0.0:beta5:*:*:*:*:*:*", "matchCriteriaId": "B67FFDE1-21D0-412E-95FB-D86A350EC9A2", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:16.0.0:beta6:*:*:*:*:*:*", "matchCriteriaId": "04F71865-1B3E-4882-B316-87AEAEB84A9F", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:16.0.0:beta7:*:*:*:*:*:*", "matchCriteriaId": "CF914799-7DA1-4B93-9445-1DFCD72D6A6B", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:16.0.0:beta8:*:*:*:*:*:*", "matchCriteriaId": "3DE7DE50-D9B1-48D9-A8F8-2DF34B80BC6C", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:16.0.0:beta9:*:*:*:*:*:*", "matchCriteriaId": "2E8C22CB-3247-47F9-8E54-F694437090ED", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:17.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "2C8C94BE-5D08-4563-AF15-5FC06BB679AB", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:17.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "987FAB5C-E1EC-4831-9AA0-FAD35A376584", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:17.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "FAF77E7D-D445-480D-BEBF-A071B58475C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:17.0.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "570418D1-09E9-4A39-8F19-D4ABC1788983", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:17.0.0:beta5:*:*:*:*:*:*", "matchCriteriaId": "4D0F4031-84D6-4E8D-AED5-D8C1E5ED3CCD", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:17.0.0:beta6:*:*:*:*:*:*", "matchCriteriaId": "F2B316FE-6214-46FA-88FF-F684DD3D53C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:17.0.0:beta7:*:*:*:*:*:*", "matchCriteriaId": "D8FA77A9-A4AF-404A-B144-97A3CE679444", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:17.0.0:beta8:*:*:*:*:*:*", "matchCriteriaId": "6A9DB6A0-6C09-44F9-A76B-7600E9B44CDB", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:17.0.0:beta9:*:*:*:*:*:*", "matchCriteriaId": "470F4DB3-4AB0-402F-A18C-22A430993F3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:18.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "11BEDA0E-71FE-4D37-B06F-FA4B281CD970", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:18.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "05B3D931-5802-471E-AE40-9282CC03E4A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:18.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "56721A2E-45B2-4D19-B25D-DD8628185B97", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:18.0.0:beta4:*:*:*:*:*:*", "matchCriteriaId": "577CBB14-4AEF-4CF2-B203-88055A68810D", "vulnerable": true}, {"criteria": "cpe:2.3:a:electronjs:electron:18.0.0:beta5:*:*:*:*:*:*", "matchCriteriaId": "16A23DCC-2355-4431-A452-40BC95D3164E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`."}, {"lang": "es", "value": "Electron es un marco de trabajo para escribir aplicaciones de escritorio multiplataforma utilizando JavaScript (JS), HTML y CSS. Una vulnerabilidad en las versiones anteriores a 18.0.0-beta.6, 17.2.0, 16.2.6 y 15.5.5 permite que un renderizador con ejecuci\u00f3n de JS obtenga acceso a un nuevo proceso de renderizaci\u00f3n con \"nodeIntegrationInSubFrames\" habilitado, lo que a su vez permite el acceso efectivo a \"ipcRenderer\". La opci\u00f3n \"nodeIntegrationInSubFrames\" no concede impl\u00edcitamente el acceso a Node.js. M\u00e1s bien, depende de la configuraci\u00f3n del sandbox existente. Si una aplicaci\u00f3n est\u00e1 en sandbox, entonces \"nodeIntegrationInSubFrames\" s\u00f3lo da acceso a las APIs del renderizador en sandbox, que incluyen \"ipcRenderer\". Si la aplicaci\u00f3n expone adicionalmente mensajes IPC sin la comprobaci\u00f3n de IPC \"senderFrame\" que llevan a cabo acciones privilegiadas o devuelven datos confidenciales este acceso a \"ipcRenderer\" puede a su vez comprometer su aplicaci\u00f3n / usuario incluso con el sandbox habilitado. Electron versiones 18.0.0-beta.6, 17.2.0, 16.2.6 y 15.5.5 contienen una correcci\u00f3n para este problema. Como soluci\u00f3n, aseg\u00farese de que todos los manejadores de mensajes IPC comprueban apropiadamente \"senderFrame\""}], "id": "CVE-2022-29247", "lastModified": "2024-11-21T06:58:48.040", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 2.2, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-13T21:15:07.763", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-668"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 62A3846F-57BE-4ABE-A656-CA28FD62BA62 (string)

versionEndExcluding : 15.5.5 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:* (string)

matchCriteriaId : AA3F2F40-BD84-4541-B5B3-5DC5DC3AEC24 (string)

versionEndExcluding : 16.2.6 (string)

versionStartIncluding : 16.0.1 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 2B4978EA-362E-46C8-A56B-4F4B47237C05 (string)

versionEndExcluding : 17.2.0 (string)

versionStartIncluding : 17.0.1 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:electronjs:electron:16.0.0:beta1:*:*:*:*:*:* (string)

matchCriteriaId : DCBD6783-12BE-4D63-B403-188943FB4F02 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:electronjs:electron:16.0.0:beta2:*:*:*:*:*:* (string)

matchCriteriaId : 989D1505-66D5-4855-A8FA-58F9566FF7FB (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:electronjs:electron:16.0.0:beta3:*:*:*:*:*:* (string)

matchCriteriaId : E6C15DE2-CA55-4A42-8D64-C44068B24B93 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:electronjs:electron:16.0.0:beta4:*:*:*:*:*:* (string)

matchCriteriaId : 2A4E764B-39E3-4C93-8F7F-1ACFA66FA51B (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:electronjs:electron:16.0.0:beta5:*:*:*:*:*:* (string)

matchCriteriaId : B67FFDE1-21D0-412E-95FB-D86A350EC9A2 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:electronjs:electron:16.0.0:beta6:*:*:*:*:*:* (string)

matchCriteriaId : 04F71865-1B3E-4882-B316-87AEAEB84A9F (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:electronjs:electron:16.0.0:beta7:*:*:*:*:*:* (string)

matchCriteriaId : CF914799-7DA1-4B93-9445-1DFCD72D6A6B (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:electronjs:electron:16.0.0:beta8:*:*:*:*:*:* (string)

matchCriteriaId : 3DE7DE50-D9B1-48D9-A8F8-2DF34B80BC6C (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:electronjs:electron:16.0.0:beta9:*:*:*:*:*:* (string)

matchCriteriaId : 2E8C22CB-3247-47F9-8E54-F694437090ED (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:electronjs:electron:17.0.0:beta1:*:*:*:*:*:* (string)

matchCriteriaId : 2C8C94BE-5D08-4563-AF15-5FC06BB679AB (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:electronjs:electron:17.0.0:beta2:*:*:*:*:*:* (string)

matchCriteriaId : 987FAB5C-E1EC-4831-9AA0-FAD35A376584 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:electronjs:electron:17.0.0:beta3:*:*:*:*:*:* (string)

matchCriteriaId : FAF77E7D-D445-480D-BEBF-A071B58475C0 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:electronjs:electron:17.0.0:beta4:*:*:*:*:*:* (string)

matchCriteriaId : 570418D1-09E9-4A39-8F19-D4ABC1788983 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:electronjs:electron:17.0.0:beta5:*:*:*:*:*:* (string)

matchCriteriaId : 4D0F4031-84D6-4E8D-AED5-D8C1E5ED3CCD (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:electronjs:electron:17.0.0:beta6:*:*:*:*:*:* (string)

matchCriteriaId : F2B316FE-6214-46FA-88FF-F684DD3D53C0 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:electronjs:electron:17.0.0:beta7:*:*:*:*:*:* (string)

matchCriteriaId : D8FA77A9-A4AF-404A-B144-97A3CE679444 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:electronjs:electron:17.0.0:beta8:*:*:*:*:*:* (string)

matchCriteriaId : 6A9DB6A0-6C09-44F9-A76B-7600E9B44CDB (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:electronjs:electron:17.0.0:beta9:*:*:*:*:*:* (string)

matchCriteriaId : 470F4DB3-4AB0-402F-A18C-22A430993F3A (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:electronjs:electron:18.0.0:beta1:*:*:*:*:*:* (string)

matchCriteriaId : 11BEDA0E-71FE-4D37-B06F-FA4B281CD970 (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:electronjs:electron:18.0.0:beta2:*:*:*:*:*:* (string)

matchCriteriaId : 05B3D931-5802-471E-AE40-9282CC03E4A4 (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:electronjs:electron:18.0.0:beta3:*:*:*:*:*:* (string)

matchCriteriaId : 56721A2E-45B2-4D19-B25D-DD8628185B97 (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:electronjs:electron:18.0.0:beta4:*:*:*:*:*:* (string)

matchCriteriaId : 577CBB14-4AEF-4CF2-B203-88055A68810D (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:electronjs:electron:18.0.0:beta5:*:*:*:*:*:* (string)

matchCriteriaId : 16A23DCC-2355-4431-A452-40BC95D3164E (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Electron is a framework for writing cross-platform desktop applications using JavaScript (JS), HTML, and CSS. A vulnerability in versions prior to 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`. The `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access. Rather, it depends on the existing sandbox setting. If an application is sandboxed, then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs, which include `ipcRenderer`. If the application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled. Electron versions 18.0.0-beta.6, 17.2.0, 16.2.6, and 15.5.5 contain a fix for this issue. As a workaround, ensure that all IPC message handlers appropriately validate `senderFrame`. (string)

}

1 : { »

lang : es (string)

value : Electron es un marco de trabajo para escribir aplicaciones de escritorio multiplataforma utilizando JavaScript (JS), HTML y CSS. Una vulnerabilidad en las versiones anteriores a 18.0.0-beta.6, 17.2.0, 16.2.6 y 15.5.5 permite que un renderizador con ejecución de JS obtenga acceso a un nuevo proceso de renderización con "nodeIntegrationInSubFrames" habilitado, lo que a su vez permite el acceso efectivo a "ipcRenderer". La opción "nodeIntegrationInSubFrames" no concede implícitamente el acceso a Node.js. Más bien, depende de la configuración del sandbox existente. Si una aplicación está en sandbox, entonces "nodeIntegrationInSubFrames" sólo da acceso a las APIs del renderizador en sandbox, que incluyen "ipcRenderer". Si la aplicación expone adicionalmente mensajes IPC sin la comprobación de IPC "senderFrame" que llevan a cabo acciones privilegiadas o devuelven datos confidenciales este acceso a "ipcRenderer" puede a su vez comprometer su aplicación / usuario incluso con el sandbox habilitado. Electron versiones 18.0.0-beta.6, 17.2.0, 16.2.6 y 15.5.5 contienen una corrección para este problema. Como solución, asegúrese de que todos los manejadores de mensajes IPC comprueban apropiadamente "senderFrame" (string)

}

]

id : CVE-2022-29247 (string)

lastModified : 2024-11-21T06:58:48.040 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 6.8 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 2.2 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 0.7 (number)

impactScore : 1.4 (number)

source : security-advisories@github.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2022-06-13T21:15:07.763 (string)

references : [ »

0 : { »

source : security-advisories@github.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://github.com/electron/electron/security/advisories/GHSA-mq8j-3h7h-p8g7 (string)

}

]

sourceIdentifier : security-advisories@github.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-668 (string)

}

]

source : security-advisories@github.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object