GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2022-21718

Vulnerability from fkie_nvd - Published: 2022-03-22 17:15 - Updated: 2026-06-17 04:26
Severity
3.4 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
5.0 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Summary
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.
References
security-advisories@github.comhttps://github.com/electron/electron/pull/32178Issue Tracking, Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/electron/electron/pull/32240Issue Tracking, Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/electron/electron/pull/32178Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/electron/electron/pull/32240Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749Mitigation, Third Party Advisory
Impacted products
Vendor Product Version
electronjs electron *
electronjs electron *
electronjs electron *
electronjs electron *
electronjs electron 17.0.0
electronjs electron 17.0.0
electronjs electron 17.0.0
electronjs electron 17.0.0
electronjs electron 17.0.0
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "electron",
          "vendor": "electron",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 13.6.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 14.0.0-beta.1, \u003c 14.2.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 15.0.0-beta.1, \u003c 15.3.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 16.0.0-beta.1, \u003c 16.0.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 17.0.0-alpha.1, \u003c= 17.0.0-alpha.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4548B4FE-05C7-4B38-9BD9-F687DBFC0393",
              "versionEndExcluding": "13.6.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A99CE214-CE9E-4241-B883-7201A737D111",
              "versionEndExcluding": "14.2.4",
              "versionStartIncluding": "14.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "619E557E-1349-4591-B668-A50BF968C28A",
              "versionEndExcluding": "15.3.5",
              "versionStartIncluding": "15.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1B857C2-D1BD-4605-ABE1-497BDD5A4825",
              "versionEndExcluding": "16.0.6",
              "versionStartIncluding": "16.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:17.0.0:alpha1:*:*:*:*:*:*",
              "matchCriteriaId": "75600E5E-B4CB-4924-9CFD-E2877FFCCB81",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:17.0.0:alpha2:*:*:*:*:*:*",
              "matchCriteriaId": "AB42380B-2AE9-481E-BF57-1014E613D7AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:17.0.0:alpha3:*:*:*:*:*:*",
              "matchCriteriaId": "4F76DDDC-1924-45C6-AB59-BD7BEA604098",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:17.0.0:alpha4:*:*:*:*:*:*",
              "matchCriteriaId": "9C58C2CC-E9C0-4751-8254-41CFCDD24982",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:electronjs:electron:17.0.0:alpha5:*:*:*:*:*:*",
              "matchCriteriaId": "E72DDD37-90EF-4517-8AEF-C3B584269C62",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue."
    },
    {
      "lang": "es",
      "value": "Electron es un marco de trabajo para escribir aplicaciones de escritorio multiplataforma usando JavaScript, HTML y CSS. Una vulnerabilidad en las versiones anteriores a \"17.0.0-alpha.6\", \"16.0.6\", \"15.3.5\", \"14.2.4\" y \"13.6.6\" permite a renderizadores obtener acceso a un dispositivo bluetooth por medio de la API bluetooth de la web si la aplicaci\u00f3n no ha configurado un controlador de eventos personalizado \"select-bluetooth-device\". Esto ha sido parcheado y las versiones de Electron \"17.0.0-alpha.6\", \"16.0.6\", \"15.3.5\", \"14.2.4\" y \"13.6.6\" contienen la correcci\u00f3n. El c\u00f3digo del aviso de seguridad de GitHub puede a\u00f1adirse a la aplicaci\u00f3n para mitigar el problema"
    }
  ],
  "id": "CVE-2022-21718",
  "lastModified": "2026-06-17T04:26:50.913",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.4,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-21718",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-23T14:08:46.712540Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2022-03-22T17:15:07.810",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/electron/electron/pull/32178"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/electron/electron/pull/32240"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/electron/electron/pull/32178"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/electron/electron/pull/32240"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.