CVE-2017-1000424 - Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control

Back Back to CVE browser

MEDIUM

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control

Published Jan 2, 2018

4.3

MEDIUM

CVSS 3.0

EPSS 0.98%

Description

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	electron	1.7.0	1.7.6

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-290

Authentication Bypass by Spoofing

CWE-345

References (5)

https://github.com/advisories/GHSA-6h98-cf9g-vmg2
Advisory
https://github.com/electron/electron/pull/10008
x_refsource_CONFIRMThird Party Advisory
https://github.com/electron/electron/pull/10008/files
x_refsource_CONFIRMThird Party Advisory
https://github.com/electron/electron/releases/tag/v1.7.6
https://nvd.nist.gov/vuln/detail/CVE-2017-1000424

Link	Providers	Tags
https://github.com/advisories/GHSA-6h98-cf9g-vmg2		Advisory
https://github.com/electron/electron/pull/10008		x_refsource_CONFIRMThird Party Advisory
https://github.com/electron/electron/pull/10008/files		x_refsource_CONFIRMThird Party Advisory
https://github.com/electron/electron/releases/tag/v1.7.6
https://nvd.nist.gov/vuln/detail/CVE-2017-1000424