Improper Authentication Affecting electron package, versions <18.3.11


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.18% (56th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Authentication vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-ELECTRON-2992482
  • published25 Aug 2022
  • disclosed25 Aug 2022
  • creditAxel Chong

Introduced: 25 Aug 2022

CVE-2022-2860  (opens in a new tab)
CWE-287  (opens in a new tab)

How to fix?

Upgrade electron to version 18.3.11 or higher.

Overview

electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS.

Affected versions of this package are vulnerable to Improper Authentication by allowing the creation of cookies that have an empty name field and whose value impersonates a cookie name prefix.

Note:

Upgrading to the fixed version will delete any previously stored cookies that meet the conditions by causing them to fail their IsCanonical() check.

CVSS Scores

version 3.1