Lucene search
Fluid AttacksCVELIST:CVE-2022-25224HistoryMay 20, 2022 - 11:04 a.m.
CVE-2022-25224
2022-05-2011:04:12
Fluid Attacks
www.cve.org
2
xss attack
malicious links
proton v0.2.0
nodejs features
os commands
EPSS
0.001
Percentile
24.8%
Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The ‘nodeIntegration’ configuration is set to on which allows the ‘webpage’ to use ‘NodeJs’ features, an attacker can leverage this to run OS commands.
CNA Affected
[
{
"product": "Proton",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "0.2.0"
}
]
}
]References
Related
nvd
nvd
CVE-2022-25224
2022-05-20 12:15:10
osv
osv
CVE-2022-25224
2022-05-20 12:15:10
cve
cve
CVE-2022-25224
2022-05-20 12:15:10
prion
prion
Design/Logic Flaw
2022-05-20 12:15:00