5.4med
CVE-2022-25224
Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file.
Published 4 y ago · modified 4 mo ago · JSON
CVSS
5.4
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 50%
Public exploits
0
none known
Summary
Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the current frame allowing an attacker to host JavaScript code in the malicious link in order to trigger an XSS attack. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.
Exploit prediction (EPSS)
0.63% probability of exploitation in the next 30 days, higher than 50% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- n/a Proton
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- fluidattacks.com /advisories/lennon/ · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2022-25224
- NVD: CVE-2022-25224
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.