Description

Github Electron version 1.6.4 - 1.6.11 and 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.

Remediation

References

https://github.com/electron/electron/pull/10008/files

https://github.com/electron/electron/pull/10008

Related Vulnerabilities

CVE-2021-23448 Vulnerability in npm package config-handler

CVE-2019-10797 Vulnerability in maven package org.wso2.transport.http:org.wso2.transport.http.netty

CVE-2019-12419 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-sso-oidc

CVE-2022-2079 Vulnerability in npm package nocodb

CVE-2021-21422 Vulnerability in npm package mongo-express

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Tags

Third Party Advisory NVD-CWE-noinfo