Vulnerability-Lookup

CVE-2020-4075 (GCVE-0-2020-4075)

Vulnerability from cvelistv5 – Published: 2020-07-07 00:05 – Updated: 2024-08-04 07:52

Title

Arbitrary file read via window-open IPC in Electron

Summary

In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-552 - {"CWE-552":"Files or Directories Accessible to External Parties"}

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://www.electronjs.org/releases/stable?page=3…	x_refsource_MISC
https://github.com/electron/electron/security/adv…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
electron	electron	Affected: >= 9.0.0-beta.0, <= 9.0.0-beta.20 Affected: >= 8.0.0, < 8.2.4 Affected: < 7.2.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:52:20.843Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.0.0-beta.0, \u003c= 9.0.0-beta.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.2.4"
            },
            {
              "status": "affected",
              "version": "\u003c 7.2.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "{\"CWE-552\":\"Files or Directories Accessible to External Parties\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-07T00:05:28.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm"
        }
      ],
      "source": {
        "advisory": "GHSA-f9mq-jph6-9mhm",
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary file read via window-open IPC in Electron",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-4075",
          "STATE": "PUBLIC",
          "TITLE": "Arbitrary file read via window-open IPC in Electron"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "electron",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 9.0.0-beta.0, \u003c= 9.0.0-beta.20"
                          },
                          {
                            "version_value": "\u003e= 8.0.0, \u003c 8.2.4"
                          },
                          {
                            "version_value": "\u003c 7.2.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "electron"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-552\":\"Files or Directories Accessible to External Parties\"}"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824",
              "refsource": "MISC",
              "url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"
            },
            {
              "name": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm",
              "refsource": "CONFIRM",
              "url": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-f9mq-jph6-9mhm",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-4075",
    "datePublished": "2020-07-07T00:05:28.000Z",
    "dateReserved": "2019-12-30T00:00:00.000Z",
    "dateUpdated": "2024-08-04T07:52:20.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-4075",
      "date": "2026-09-17",
      "epss": "0.01175",
      "percentile": "0.66046"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.0.0\", \"versionEndExcluding\": \"7.2.4\", \"matchCriteriaId\": \"B52CBB9A-2E1B-4ED7-8DAD-33B5CD063D45\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndExcluding\": \"8.2.4\", \"matchCriteriaId\": \"31A476AD-CF63-41DE-8B71-7CB8CB828BA7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"87556FB9-4AEC-4C3A-8DF6-4480728C8605\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FB793B7F-1C9D-445D-A849-CB28577CA760\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C340AA9-8D81-4927-9447-DFCF0DD385AC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8DF366B-644E-4C43-9DF1-37F1ADD36532\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*\", \"matchCriteriaId\": \"BAC64CED-4F36-4667-B909-4265DDEBDA3F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*\", \"matchCriteriaId\": \"17574861-A808-406A-9B0D-403AD99EA160\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*\", \"matchCriteriaId\": \"79CB734A-05B3-4388-BD8F-ECD3FD699D87\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*\", \"matchCriteriaId\": \"7E0E7E72-B138-4E09-BEE0-219643377314\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*\", \"matchCriteriaId\": \"B19F82AA-3660-4AC5-920E-7E36534ADF36\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*\", \"matchCriteriaId\": \"29850E51-1EB9-4E9E-9AAC-ACAC12CDCAB6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*\", \"matchCriteriaId\": \"84544C05-24A7-4CDE-B6E1-EC05B6CD9836\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*\", \"matchCriteriaId\": \"A8AF3443-F01C-407F-BEE2-A8E601A09211\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"F962D5DC-C4EE-42C0-9BA8-C17B5ADAE178\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*\", \"matchCriteriaId\": \"EB7A193D-7B1F-45F0-B385-DE8C75D7088D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*\", \"matchCriteriaId\": \"4BFFB27D-B11F-4F5B-8624-27042F8A664A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF67CE0D-79D8-4CCC-8152-6989D681B618\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*\", \"matchCriteriaId\": \"965FE481-DC51-4123-B47A-4825E7231B33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*\", \"matchCriteriaId\": \"AAC42DF7-3344-4C5C-B01A-B24F7C7FA47A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*\", \"matchCriteriaId\": \"5CA4015A-6D70-490E-AEFD-1C64F582F9DA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*\", \"matchCriteriaId\": \"72B0EAB3-F11C-42B3-8F4A-3D4B652A2740\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*\", \"matchCriteriaId\": \"F2F409DE-D2A1-49A6-AA57-D735F4B07D29\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.\"}, {\"lang\": \"es\", \"value\": \"En Electron antes de las versiones 7.2.4, 8.2.4 y 9.0.0-beta21, una lectura arbitraria de archivos locales es posible al definir opciones de ventana no seguras en una ventana secundaria abierta por medio de window.open. Como soluci\\u00f3n alternativa, aseg\\u00farense de llamar a la funci\\u00f3n \\\"event.preventDefault()\\\" en todos los eventos de ventanas nuevas donde la \\\"url\\\" u \\\"options\\\" no es algo que se espera. Esto es corregido en las versiones 9.0.0-beta.21, 8.2.4 y 7.2.4\"}]",
      "id": "CVE-2020-4075",
      "lastModified": "2024-11-21T05:32:15.530",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 6.8, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.2, \"impactScore\": 4.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 2.1, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"LOW\", \"exploitabilityScore\": 3.9, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2020-07-07T00:15:10.513",
      "references": "[{\"url\": \"https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-552\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-552\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-4075\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2020-07-07T00:15:10.513\",\"lastModified\":\"2024-11-21T05:32:15.530\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.\"},{\"lang\":\"es\",\"value\":\"En Electron antes de las versiones 7.2.4, 8.2.4 y 9.0.0-beta21, una lectura arbitraria de archivos locales es posible al definir opciones de ventana no seguras en una ventana secundaria abierta por medio de window.open. Como soluci\u00f3n alternativa, aseg\u00farense de llamar a la funci\u00f3n \\\"event.preventDefault()\\\" en todos los eventos de ventanas nuevas donde la \\\"url\\\" u \\\"options\\\" no es algo que se espera. Esto es corregido en las versiones 9.0.0-beta.21, 8.2.4 y 7.2.4\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":2.1,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-552\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-552\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0.0\",\"versionEndExcluding\":\"7.2.4\",\"matchCriteriaId\":\"B52CBB9A-2E1B-4ED7-8DAD-33B5CD063D45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.2.4\",\"matchCriteriaId\":\"31A476AD-CF63-41DE-8B71-7CB8CB828BA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"87556FB9-4AEC-4C3A-8DF6-4480728C8605\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB793B7F-1C9D-445D-A849-CB28577CA760\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C340AA9-8D81-4927-9447-DFCF0DD385AC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8DF366B-644E-4C43-9DF1-37F1ADD36532\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*\",\"matchCriteriaId\":\"BAC64CED-4F36-4667-B909-4265DDEBDA3F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*\",\"matchCriteriaId\":\"17574861-A808-406A-9B0D-403AD99EA160\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*\",\"matchCriteriaId\":\"79CB734A-05B3-4388-BD8F-ECD3FD699D87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E0E7E72-B138-4E09-BEE0-219643377314\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*\",\"matchCriteriaId\":\"B19F82AA-3660-4AC5-920E-7E36534ADF36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*\",\"matchCriteriaId\":\"29850E51-1EB9-4E9E-9AAC-ACAC12CDCAB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*\",\"matchCriteriaId\":\"84544C05-24A7-4CDE-B6E1-EC05B6CD9836\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*\",\"matchCriteriaId\":\"A8AF3443-F01C-407F-BEE2-A8E601A09211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"F962D5DC-C4EE-42C0-9BA8-C17B5ADAE178\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB7A193D-7B1F-45F0-B385-DE8C75D7088D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BFFB27D-B11F-4F5B-8624-27042F8A664A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF67CE0D-79D8-4CCC-8152-6989D681B618\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*\",\"matchCriteriaId\":\"965FE481-DC51-4123-B47A-4825E7231B33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*\",\"matchCriteriaId\":\"AAC42DF7-3344-4C5C-B01A-B24F7C7FA47A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CA4015A-6D70-490E-AEFD-1C64F582F9DA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*\",\"matchCriteriaId\":\"72B0EAB3-F11C-42B3-8F4A-3D4B652A2740\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*\",\"matchCriteriaId\":\"F2F409DE-D2A1-49A6-AA57-D735F4B07D29\"}]}]}],\"references\":[{\"url\":\"https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-22T16:57:59+00:00",
      "cve": "CVE-2020-4075",
      "id": "CVE-2020-4075",
      "initial_release_date": "2020-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Arbitrary file read via window-open IPC in Electron",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-4075.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2020-4075

Vulnerability from fkie_nvd - Published: 2020-07-07 00:15 - Updated: 2026-06-17 03:19

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm	Third Party Advisory
security-advisories@github.com	https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824	Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824	Release Notes, Vendor Advisory

Impacted products

Vendor	Product	Version
electronjs	electron	*
electronjs	electron	*
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0
electronjs	electron	9.0.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 9.0.0-beta.0, \u003c= 9.0.0-beta.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 8.0.0, \u003c 8.2.4"
            },
            {
              "status": "affected",
              "version": "\u003c 7.2.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B52CBB9A-2E1B-4ED7-8DAD-33B5CD063D45",
              "versionEndExcluding": "7.2.4",
              "versionStartIncluding": "7.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "31A476AD-CF63-41DE-8B71-7CB8CB828BA7",
              "versionEndExcluding": "8.2.4",
              "versionStartIncluding": "8.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "87556FB9-4AEC-4C3A-8DF6-4480728C8605",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "FB793B7F-1C9D-445D-A849-CB28577CA760",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*",
              "matchCriteriaId": "0C340AA9-8D81-4927-9447-DFCF0DD385AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*",
              "matchCriteriaId": "D8DF366B-644E-4C43-9DF1-37F1ADD36532",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*",
              "matchCriteriaId": "BAC64CED-4F36-4667-B909-4265DDEBDA3F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*",
              "matchCriteriaId": "17574861-A808-406A-9B0D-403AD99EA160",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*",
              "matchCriteriaId": "79CB734A-05B3-4388-BD8F-ECD3FD699D87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*",
              "matchCriteriaId": "7E0E7E72-B138-4E09-BEE0-219643377314",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*",
              "matchCriteriaId": "B19F82AA-3660-4AC5-920E-7E36534ADF36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*",
              "matchCriteriaId": "29850E51-1EB9-4E9E-9AAC-ACAC12CDCAB6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*",
              "matchCriteriaId": "84544C05-24A7-4CDE-B6E1-EC05B6CD9836",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*",
              "matchCriteriaId": "A8AF3443-F01C-407F-BEE2-A8E601A09211",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "F962D5DC-C4EE-42C0-9BA8-C17B5ADAE178",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*",
              "matchCriteriaId": "EB7A193D-7B1F-45F0-B385-DE8C75D7088D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*",
              "matchCriteriaId": "4BFFB27D-B11F-4F5B-8624-27042F8A664A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "AF67CE0D-79D8-4CCC-8152-6989D681B618",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*",
              "matchCriteriaId": "965FE481-DC51-4123-B47A-4825E7231B33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*",
              "matchCriteriaId": "AAC42DF7-3344-4C5C-B01A-B24F7C7FA47A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*",
              "matchCriteriaId": "5CA4015A-6D70-490E-AEFD-1C64F582F9DA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*",
              "matchCriteriaId": "72B0EAB3-F11C-42B3-8F4A-3D4B652A2740",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*",
              "matchCriteriaId": "F2F409DE-D2A1-49A6-AA57-D735F4B07D29",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4."
    },
    {
      "lang": "es",
      "value": "En Electron antes de las versiones 7.2.4, 8.2.4 y 9.0.0-beta21, una lectura arbitraria de archivos locales es posible al definir opciones de ventana no seguras en una ventana secundaria abierta por medio de window.open. Como soluci\u00f3n alternativa, aseg\u00farense de llamar a la funci\u00f3n \"event.preventDefault()\" en todos los eventos de ventanas nuevas donde la \"url\" u \"options\" no es algo que se espera. Esto es corregido en las versiones 9.0.0-beta.21, 8.2.4 y 7.2.4"
    }
  ],
  "id": "CVE-2020-4075",
  "lastModified": "2026-06-17T03:19:31.467",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-07-07T00:15:10.513",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-552"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-F9MQ-JPH6-9MHM

Vulnerability from github – Published: 2020-07-07 00:01 – Updated: 2021-01-07 23:48

Summary

Arbitrary file read via window-open IPC in Electron

Details

Impact

The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.

Workarounds

Ensure you are calling event.preventDefault() on all new-window events where the url or options is not something you expect.

Fixed Versions

9.0.0-beta.21
8.2.4
7.2.4

For more information

If you have any questions or comments about this advisory: * Email us at security@electronjs.org

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "electron"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "8.0.0"
            },
            {
              "fixed": "8.2.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-4075"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-552"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-07-06T23:54:56Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.\n\n### Workarounds\nEnsure you are calling `event.preventDefault()` on all [`new-window`](https://electronjs.org/docs/api/web-contents#event-new-window) events where the `url` or `options` is not something you expect.\n\n### Fixed Versions\n* `9.0.0-beta.21`\n* `8.2.4`\n* `7.2.4`\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@electronjs.org](mailto:security@electronjs.org)",
  "id": "GHSA-f9mq-jph6-9mhm",
  "modified": "2021-01-07T23:48:36Z",
  "published": "2020-07-07T00:01:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4075"
    },
    {
      "type": "WEB",
      "url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Arbitrary file read via window-open IPC in Electron"
}

GSD-2020-4075

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2020-4075

Aliases

CVE-2020-4075

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-4075",
    "description": "In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.",
    "id": "GSD-2020-4075"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-4075"
      ],
      "details": "In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.",
      "id": "GSD-2020-4075",
      "modified": "2023-12-13T01:21:48.006859Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2020-4075",
        "STATE": "PUBLIC",
        "TITLE": "Arbitrary file read via window-open IPC in Electron"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "electron",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 9.0.0-beta.0, \u003c= 9.0.0-beta.20"
                        },
                        {
                          "version_value": "\u003e= 8.0.0, \u003c 8.2.4"
                        },
                        {
                          "version_value": "\u003c 7.2.4"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "electron"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "{\"CWE-552\":\"Files or Directories Accessible to External Parties\"}"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824",
            "refsource": "MISC",
            "url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"
          },
          {
            "name": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm",
            "refsource": "CONFIRM",
            "url": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-f9mq-jph6-9mhm",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=7.0.0 \u003c7.2.4||\u003e=8.0.0 \u003c8.2.4||=9.0.0",
          "affected_versions": "All versions starting from 7.0.0 before 7.2.4, all versions starting from 8.0.0 before 8.2.4, version 9.0.0",
          "cvss_v2": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-552",
            "CWE-937"
          ],
          "date": "2020-07-13",
          "description": "In Electron, an arbitrary local file read is possible by defining unsafe window options on a child window opened via `window.open.` As a workaround, ensure you are calling `event.preventDefault()` on all `new-window` events where the `url` or `options` is not something you expect.",
          "fixed_versions": [
            "7.2.4",
            "8.2.4",
            "9.0.1"
          ],
          "identifier": "CVE-2020-4075",
          "identifiers": [
            "CVE-2020-4075",
            "GHSA-f9mq-jph6-9mhm"
          ],
          "not_impacted": "All versions before 7.0.0, all versions starting from 7.2.4 before 8.0.0, all versions starting from 8.2.4 before 9.0.0, all versions after 9.0.0",
          "package_slug": "npm/electron",
          "pubdate": "2020-07-07",
          "solution": "Upgrade to versions 7.2.4, 8.2.4, 9.0.1 or above.",
          "title": "Files or Directories Accessible to External Parties",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-4075",
            "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"
          ],
          "uuid": "d5b3f9d3-1e71-4f30-acaa-b50c88be9100"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "7.2.4",
                "versionStartIncluding": "7.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "8.2.4",
                "versionStartIncluding": "8.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:-:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta10:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta11:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta12:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta13:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta14:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta15:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta16:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta17:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta18:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta19:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta20:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta4:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta5:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta6:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta7:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta8:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:electronjs:electron:9.0.0:beta9:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-4075"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-552"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824",
              "refsource": "MISC",
              "tags": [
                "Release Notes",
                "Vendor Advisory"
              ],
              "url": "https://www.electronjs.org/releases/stable?page=3#release-notes-for-v824"
            },
            {
              "name": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/electron/electron/security/advisories/GHSA-f9mq-jph6-9mhm"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2020-07-13T18:51Z",
      "publishedDate": "2020-07-07T00:15Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-4075 (GCVE-0-2020-4075)

FKIE_CVE-2020-4075

GHSA-F9MQ-JPH6-9MHM

Impact

Workarounds

Fixed Versions

For more information

GSD-2020-4075

Tags

Sightings

Nomenclature

Related by attack behaviour