{"id":"CVE-2022-21718","published":"2022-03-22T16:25:12Z","modified":"2025-04-23T18:45:03Z","title":"Renderers can obtain access to random bluetooth device without permission in Electron","vendor":"electron","product":"electron","tier":"tail","description":{"text":"Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. A vulnerability in versions prior to `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` allows renderers to obtain access to a bluetooth device via the web bluetooth API if the app has not configured a custom `select-bluetooth-device` event handler. This has been patched and Electron versions `17.0.0-alpha.6`, `16.0.6`, `15.3.5`, `14.2.4`, and `13.6.6` contain the fix. Code from the GitHub Security Advisory can be added to the app to work around the issue.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.4,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00946,"percentile":0.60982,"provenance":"source"},"cwes":[{"id":"CWE-668","name":"Exposure of Resource to Wrong Sphere"}],"references":[{"url":"https://github.com/electron/electron/security/advisories/GHSA-3p22-ghq8-v749","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/electron/electron/pull/32178","tags":["x_refsource_MISC"]},{"url":"https://github.com/electron/electron/pull/32240","tags":["x_refsource_MISC"]}],"priority":{"score":14.6,"factors":[{"name":"EPSS percentile","points":12.2},{"name":"CVSS severity","points":2.38}]},"vendorSlug":"electron","affectedVersions":[{"vendor":"electron","product":"electron","versions":["< 13.6.6",">= 14.0.0-beta.1, < 14.2.4",">= 15.0.0-beta.1, < 15.3.5",">= 16.0.0-beta.1, < 16.0.6",">= 17.0.0-alpha.1, <= 17.0.0-alpha.5"]}],"affected":[{"ecosystem":"npm","package":"electron","vulnerableRanges":["<13.6.6",">=14.0.0-beta.1, <14.2.4",">=15.0.0-beta.1, <15.3.5",">=16.0.0-beta.1, <16.0.6",">=17.0.0-alpha.1, <17.0.0-alpha.6"],"patched":["13.6.6","14.2.4","15.3.5","16.0.6","17.0.0-alpha.6"],"from":["GHSA-3p22-ghq8-v749"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-1290","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-15215","published":"2020-10-06","fixed":"11.0.0-beta.6","kev":false},{"cve":"CVE-2020-26272","published":"2021-01-28","fixed":"11.1.0","kev":false},{"cve":"CVE-2021-39184","published":"2021-10-12","fixed":"13.3.0","kev":false,"link":{"from":"CVE-2021-39184","to":"CVE-2022-21718","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:electron","fromFixed":"13.3.0","toFixed":"13.6.6","daysApart":161}]}},{"cve":"CVE-2022-21718","published":"2022-03-22","fixed":"17.0.0-alpha.6","kev":false},{"cve":"CVE-2022-29247","published":"2022-06-13","fixed":"18.0.0-beta.6","kev":false},{"cve":"CVE-2022-29257","published":"2022-06-13","fixed":"18.0.0-beta.6","kev":false,"link":{"from":"CVE-2022-21718","to":"CVE-2022-29257","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:electron","fromFixed":"15.3.5","toFixed":"15.5.0","daysApart":83},{"kind":"version-step","provenance":"source","package":"npm:electron","fromFixed":"16.0.6","toFixed":"16.2.0","daysApart":83}]}},{"cve":"CVE-2022-4135","published":"2022-11-25","fixed":"19.1.8","kev":true}],"package":"npm:electron"}}