CVE-2020-26272 (Medium) detected in electronv12.0.0-nightly.20201005

[mend-bolt-for-github]

CVE-2020-26272 - Medium Severity Vulnerability

Vulnerable Library - electronv12.0.0-nightly.20201005

Build cross-platform desktop apps with JavaScript, HTML, and CSS

Library home page: https://github.com/electron/electron.git

Found in HEAD commit: 4fc35a18c3a967d9d6e32b851af8115908feeac9

Found in base branch: master

Vulnerable Source Files (1)

/shell/common/gin_helper/event_emitter.cc

Vulnerability Details

The Electron framework lets you write cross-platform desktop applications using JavaScript, HTML and CSS. In affected versions of Electron IPC messages sent from the main process to a subframe in the renderer process, through webContents.sendToFrame, event.reply or when using the remote module, can in some cases be delivered to the wrong frame. If your app uses remote, calls webContents.sendToFrame, or calls event.reply in an IPC message handler then it is impacted by this issue. This has been fixed in versions 9.4.0, 10.2.0, 11.1.0, and 12.0.0-beta.9. There are no workarounds for this issue.

Publish Date: 2021-01-28

URL: CVE-2020-26272

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26272

Release Date: 2021-01-28

Fix Resolution: electron - 9.4.0,10.2.0,11.1.0,12.0.0-beta.9

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-bolt-for-github]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.