{"containers": {"cna": {"affected": [{"product": "Proton", "vendor": "n/a", "versions": [{"status": "affected", "version": "0.2.0"}]}], "descriptions": [{"lang": "en", "value": "Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands."}], "problemTypes": [{"descriptions": [{"description": "XSS to RCE", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-05-20T11:04:12", "orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "shortName": "Fluid Attacks"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://fluidattacks.com/advisories/lennon/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "help@fluidattacks.com", "ID": "CVE-2022-25224", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Proton", "version": {"version_data": [{"version_value": "0.2.0"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "XSS to RCE"}]}]}, "references": {"reference_data": [{"name": "https://fluidattacks.com/advisories/lennon/", "refsource": "MISC", "url": "https://fluidattacks.com/advisories/lennon/"}]}}}}, "cveMetadata": {"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869", "assignerShortName": "Fluid Attacks", "cveId": "CVE-2022-25224", "datePublished": "2022-05-20T11:04:12", "dateReserved": "2022-02-15T00:00:00", "dateUpdated": "2022-05-20T11:04:12", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:proton_project:proton:0.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "9AF0DFCA-0F88-437E-8E07-F223ED15C4B8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands."}, {"lang": "es", "value": "Proton versi\u00f3n v0.2.0, permite a un atacante crear un enlace malicioso dentro de un archivo markdown. Cuando la v\u00edctima hace clic en el enlace, la aplicaci\u00f3n abre el sitio en el marco actual permitiendo a un atacante alojar c\u00f3digo JavaScript en el enlace malicioso para desencadenar un ataque de tipo XSS. La configuraci\u00f3n \"nodeIntegration\" est\u00e1 habilitada, lo que permite a la p\u00e1gina web usar las caracter\u00edsticas de \"NodeJs\", un atacante puede aprovechar esto para ejecutar comandos del Sistema Operativo"}], "id": "CVE-2022-25224", "lastModified": "2022-05-31T15:33:01.343", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-20T12:15:10.883", "references": [{"source": "help@fluidattacks.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://fluidattacks.com/advisories/lennon/"}], "sourceIdentifier": "help@fluidattacks.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}