CVE-2020-4075
07.07.2020, 00:15
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not something you expect. This is fixed in versions 9.0.0-beta.21, 8.2.4 and 7.2.4.Enginsight
| Vendor | Product | Version |
|---|---|---|
| electronjs | electron | 7.0.0 ≤ 𝑥 < 7.2.4 |
| electronjs | electron | 8.0.0 ≤ 𝑥 < 8.2.4 |
| electronjs | electron | 9.0.0 |
| electronjs | electron | 9.0.0:beta1 |
| electronjs | electron | 9.0.0:beta10 |
| electronjs | electron | 9.0.0:beta11 |
| electronjs | electron | 9.0.0:beta12 |
| electronjs | electron | 9.0.0:beta13 |
| electronjs | electron | 9.0.0:beta14 |
| electronjs | electron | 9.0.0:beta15 |
| electronjs | electron | 9.0.0:beta16 |
| electronjs | electron | 9.0.0:beta17 |
| electronjs | electron | 9.0.0:beta18 |
| electronjs | electron | 9.0.0:beta19 |
| electronjs | electron | 9.0.0:beta2 |
| electronjs | electron | 9.0.0:beta20 |
| electronjs | electron | 9.0.0:beta3 |
| electronjs | electron | 9.0.0:beta4 |
| electronjs | electron | 9.0.0:beta5 |
| electronjs | electron | 9.0.0:beta6 |
| electronjs | electron | 9.0.0:beta7 |
| electronjs | electron | 9.0.0:beta8 |
| electronjs | electron | 9.0.0:beta9 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References