CVE-2016-1202

HIGH7.8EPSS 0.06%

High severity vulnerability that affects electron

發布日:2017/10/24修改日:2023/11/8

描述

Untrusted search path vulnerability in Atom Electron before 0.33.5 allows local users to gain privileges via a Trojan horse Node.js module in a parent directory of a directory named on a require line.

受影響套件(1)

npm/electronfrom 0, < 0.33.5

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH7.8	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

參考連結(7)

ADVISORYhttps://github.com/advisories/GHSA-gvcj-pfq2-wxj7
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2016-1202
PATCHhttps://github.com/electron/electron
WEBhttp://jvndb.jvn.jp/jvndb/JVNDB-2016-000054
WEBhttp://jvn.jp/en/jp/JVN00324715/index.html
WEBhttps://github.com/electron/electron/commit/9a2e2b365d061ec10cd861391fd5b1344af7194d
WEBhttps://github.com/electron/electron/pull/2976