Search for vulnerabilities
Vulnerability details: VCID-b1qd-rbd6-aaam
Vulnerability ID VCID-b1qd-rbd6-aaam
Aliases CVE-2023-23623
GHSA-gxh7-wv9q-fwfr
Summary Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. A Content-Security-Policy that disables eval, specifically setting a `script-src` directive and _not_ providing `unsafe-eval` in that directive, is not respected in renderers that have sandbox disabled. i.e. `sandbox: false` in the `webPreferences` object. This allows usage of methods like `eval()` and `new Function` unexpectedly which can result in an expanded attack surface. This issue only ever affected the 22 and 23 major versions of Electron and has been fixed in the latest versions of those release lines. Specifically, these versions contain the fixes: 22.0.1 and 23.0.0-alpha.2 We recommend all apps upgrade to the latest stable version of Electron. If upgrading isn't possible, this issue can be addressed without upgrading by enabling `sandbox: true` on all renderers.
Status Published
Exploitability 0.5
Weighted Severity 8.8
Risk 4.4
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-670 Always-Incorrect Control Flow Implementation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00170 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00501 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
epss 0.00863 https://api.first.org/data/v1/epss?cve=CVE-2023-23623
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-gxh7-wv9q-fwfr
cvssv3.1 8.8 https://github.com/electron/electron
generic_textual HIGH https://github.com/electron/electron
cvssv3.1 7.5 https://github.com/electron/electron/commit/9e7fbc7021d8d716c43782249a552e55289c35db
generic_textual HIGH https://github.com/electron/electron/commit/9e7fbc7021d8d716c43782249a552e55289c35db
cvssv3.1 7.5 https://github.com/electron/electron/pull/36667
generic_textual HIGH https://github.com/electron/electron/pull/36667
cvssv3.1 7.5 https://github.com/electron/electron/pull/36668
generic_textual HIGH https://github.com/electron/electron/pull/36668
cvssv3.1 7.5 https://github.com/electron/electron/releases/tag/v22.0.1
generic_textual HIGH https://github.com/electron/electron/releases/tag/v22.0.1
cvssv3.1 7.5 https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr
cvssv3.1_qr HIGH https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr
generic_textual HIGH https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-23623
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-23623
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2023-23623
https://github.com/electron/electron
https://github.com/electron/electron/commit/9e7fbc7021d8d716c43782249a552e55289c35db
https://github.com/electron/electron/pull/36667
https://github.com/electron/electron/pull/36668
https://github.com/electron/electron/releases/tag/v22.0.1
https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr
cpe:2.3:a:electronjs:electron:22.0.0:beta1:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:22.0.0:beta1:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:22.0.0:beta2:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:22.0.0:beta2:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:22.0.0:beta3:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:22.0.0:beta3:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:22.0.0:beta4:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:22.0.0:beta4:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:22.0.0:beta5:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:22.0.0:beta5:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:22.0.0:beta6:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:22.0.0:beta6:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:22.0.0:beta7:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:22.0.0:beta7:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:22.0.0:beta8:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:22.0.0:beta8:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:22.0.0:-:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:22.0.0:-:*:*:*:node.js:*:*
cpe:2.3:a:electronjs:electron:23.0.0:alpha1:*:*:*:node.js:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:electronjs:electron:23.0.0:alpha1:*:*:*:node.js:*:*
CVE-2023-23623 https://nvd.nist.gov/vuln/detail/CVE-2023-23623
GHSA-gxh7-wv9q-fwfr https://github.com/advisories/GHSA-gxh7-wv9q-fwfr
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/electron/electron
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/electron/electron/commit/9e7fbc7021d8d716c43782249a552e55289c35db
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/electron/electron/pull/36667
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/electron/electron/pull/36668
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/electron/electron/releases/tag/v22.0.1
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/electron/electron/security/advisories/GHSA-gxh7-wv9q-fwfr
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-23623
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-23623
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.54668
EPSS Score 0.00170
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.