CVE-2022-25229

2022-05-2011:01:18

Fluid Attacks

www.cve.org

popcorn time

stored xss

movies api server

nodejs

os commands

EPSS

0.001

Percentile

21.8%

JSON

Popcorn Time 0.4.7 has a Stored XSS in the ‘Movies API Server(s)’ field via the ‘settings’ page. The ‘nodeIntegration’ configuration is set to on which allows the ‘webpage’ to use ‘NodeJs’ features, an attacker can leverage this to run OS commands.

CNA Affected

[
  {
    "product": "Popcorn Time",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "0.4.7"
      }
    ]
  }
]

References

fluidattacks.com/advisories/bowie/

github.com/popcorn-official/popcorn-desktop/issues/2491

EPSS

0.001

Percentile

21.8%

JSON

Related for CVELIST:CVE-2022-25229