VDB
CVE-2024-27303
CVE-2024-27303
PUBLISHED
CVSS 7.300000190734863 HIGH
electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)
EPSS 0.28% · 20.4th percentile
Risk Scores
CVSS 3.1
7.300000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS Score
0.28%
20.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| electron-userland | electron-builder | < 24.13.2, < 24.13.2 |
| npm | app-builder-lib | 0, 0 |
| electron | electron-builder | 0, 0 |
| electron | electron-builder | 0, 0 |
Timeline
- Jan 21, 1970 Security Advisory
- Mar 4, 2024 CVE Published
- Mar 6, 2024 CVE Updated
- Mar 6, 2024 PoC Published
- Mar 6, 2024 PoC Published
- Mar 7, 2024 EPSS Score
- Apr 2, 2024 EPSS Score
- Apr 29, 2024 EPSS Score
- May 25, 2024 EPSS Score
- Jun 20, 2024 EPSS Score
- Jul 17, 2024 EPSS Score
- Aug 12, 2024 EPSS Score
References
- https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55 url
- https://github.com/electron-userland/electron-builder/commit/8f4acff3c2d45c1cb07779bb3fe79644408ee387 patch
- https://github.com/electron-userland/electron-builder/pull/8059 issue
- https://github.com/electron-userland/electron-builder package
- https://nvd.nist.gov/vuln/detail/CVE-2024-27303 advisory