CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-15174

In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 the `will-navigate` event that apps use to prevent navigations to unexpected destinations as per our security recommendations can be bypassed when a sub-frame performs a top-frame navigation across sites. The issue is patched in versions 11.0.0-beta.1, 10.0.1, 9.3.0 or 8.5.1 As a workaround sandbox all your iframes using the sandbox attribute. This will prevent them creating top-frame navigations and is good practice anyway.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.002

EPSS Ranking 41.3%

CVSS Severity

CVSS v3 Score 7.5

CVSS v2 Score 5.8

References

Products affected by CVE-2020-15174

Electronjs » Electron » Version: 10.0.0

cpe:2.3:a:electronjs:electron:10.0.0
Electronjs » Electron » Version: 8.0.0

cpe:2.3:a:electronjs:electron:8.0.0
Electronjs » Electron » Version: 8.0.1

cpe:2.3:a:electronjs:electron:8.0.1
Electronjs » Electron » Version: 8.0.2

cpe:2.3:a:electronjs:electron:8.0.2
Electronjs » Electron » Version: 8.0.3

cpe:2.3:a:electronjs:electron:8.0.3
Electronjs » Electron » Version: 8.1.0

cpe:2.3:a:electronjs:electron:8.1.0
Electronjs » Electron » Version: 8.1.1

cpe:2.3:a:electronjs:electron:8.1.1
Electronjs » Electron » Version: 8.2.0

cpe:2.3:a:electronjs:electron:8.2.0
Electronjs » Electron » Version: 8.2.1

cpe:2.3:a:electronjs:electron:8.2.1
Electronjs » Electron » Version: 8.2.2

cpe:2.3:a:electronjs:electron:8.2.2
Electronjs » Electron » Version: 8.2.3

cpe:2.3:a:electronjs:electron:8.2.3
Electronjs » Electron » Version: 8.2.4

cpe:2.3:a:electronjs:electron:8.2.4
Electronjs » Electron » Version: 8.2.5

cpe:2.3:a:electronjs:electron:8.2.5
Electronjs » Electron » Version: 8.3.0

cpe:2.3:a:electronjs:electron:8.3.0
Electronjs » Electron » Version: 8.3.1

cpe:2.3:a:electronjs:electron:8.3.1
Electronjs » Electron » Version: 8.3.2

cpe:2.3:a:electronjs:electron:8.3.2
Electronjs » Electron » Version: 8.3.3

cpe:2.3:a:electronjs:electron:8.3.3
Electronjs » Electron » Version: 8.3.4

cpe:2.3:a:electronjs:electron:8.3.4
Electronjs » Electron » Version: 8.4.0

cpe:2.3:a:electronjs:electron:8.4.0
Electronjs » Electron » Version: 8.4.1

cpe:2.3:a:electronjs:electron:8.4.1
Electronjs » Electron » Version: 8.5.0

cpe:2.3:a:electronjs:electron:8.5.0
Electronjs » Electron » Version: 9.0.0

cpe:2.3:a:electronjs:electron:9.0.0
Electronjs » Electron » Version: 9.0.1

cpe:2.3:a:electronjs:electron:9.0.1
Electronjs » Electron » Version: 9.0.2

cpe:2.3:a:electronjs:electron:9.0.2
Electronjs » Electron » Version: 9.0.3

cpe:2.3:a:electronjs:electron:9.0.3
Electronjs » Electron » Version: 9.0.4

cpe:2.3:a:electronjs:electron:9.0.4
Electronjs » Electron » Version: 9.0.5

cpe:2.3:a:electronjs:electron:9.0.5
Electronjs » Electron » Version: 9.0.6

cpe:2.3:a:electronjs:electron:9.0.6
Electronjs » Electron » Version: 9.1.0

cpe:2.3:a:electronjs:electron:9.1.0
Electronjs » Electron » Version: 9.1.1

cpe:2.3:a:electronjs:electron:9.1.1
Electronjs » Electron » Version: 9.1.2

cpe:2.3:a:electronjs:electron:9.1.2
Electronjs » Electron » Version: 9.2.0

cpe:2.3:a:electronjs:electron:9.2.0
Electronjs » Electron » Version: 9.2.1

cpe:2.3:a:electronjs:electron:9.2.1

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-15174

Products

Pricing

Contact Us