CVE-2018-1000136

Опубликовано: 23 мар. 2018

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13, 1.8.4, 2.0.0-beta.4.

Ссылки

https://www.electronjs.org/blog/webview-fix
Mitigation
Patch
Vendor Advisory
https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/
Exploit
Third Party Advisory
https://www.electronjs.org/blog/webview-fix
Mitigation
Patch
Vendor Advisory
https://www.trustwave.com/Resources/SpiderLabs-Blog/CVE-2018-1000136---Electron-nodeIntegration-Bypass/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*

Версия от 1.7.0 (включая) до 1.7.12 (включая)

cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*

Версия от 1.8.0 (исключая) до 1.8.3 (включая)

cpe:2.3:a:electronjs:electron:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:electronjs:electron:2.0.0:beta1:*:*:*:*:*:*

cpe:2.3:a:electronjs:electron:2.0.0:beta2:*:*:*:*:*:*

cpe:2.3:a:electronjs:electron:2.0.0:beta3:*:*:*:*:*:*

cpe:2.3:a:electronjs:electron:2.0.0:beta4:*:*:*:*:*:*

EPSS

Процентиль: 80%

0.01407

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2018-1000136

CVSS3: 8.1

redhat

почти 8 лет назад

CVE-2018-1000136

CVSS3: 8.1

debian

почти 8 лет назад

Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0 ...

GHSA-8xwg-wv7v-4vqp

CVSS3: 8.1

github

почти 8 лет назад

Electron Vulnerable to Code Execution by Re-Enabling Node.js Integration

EPSS

Процентиль: 80%

0.01407

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-20