GHSA-v3wr-67px-44xg

    Dashboard / Vulnerabilities / GHSA-v3wr-67px-44xg

    GHSA-v3wr-67px-44xg

    Published: 3 Mar 2022Last Modified: 3 Mar 2022

    Summary: Execution with Unnecessary Privileges in arc-electron

    Details: ### Impact When the end-user click on the response header that contains a link the target will be opened in ARC new window. This window will have the default preload script loaded which allows the scripts embedded in the link target to execute any logic that ARC has access to from the renderer process, which includes file system access, data store access (which may contain sensitive information), and some additional processes that only ARC should have access to. ### Patches This is patched in version 17.0.9. ### Workarounds Do not click onto any link in the response headers view. ### For more information If you have any questions or comments about this advisory: * Open an issue in [advanced-rest-client/arc-electron](https://github.com/advanced-rest-client/arc-electron) * Email us at [Salesforce Security](mailto:[email protected])

    References: https://github.com/advanced-rest-client/arc-electron/security/advisories/GHSA-v3wr-67px-44xg, https://github.com/advanced-rest-client/arc-electron

    Affected packages

    Package

    Name: @advanced-rest-client/base

    Purl: pkg:npm/%40advanced-rest-client/base

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.1.10

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-v3wr-67px-44xg | CVE-DB