PT-2022-17168
CVE-2022-25229
·
تاريخ النشر
2022-05-20
·
تاريخ التحديث
2022-05-31
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Popcorn Time version 0.4.7
Description
The issue is related to a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on, allowing the webpage to use NodeJs features. An attacker can leverage this to run OS commands.
Recommendations
For Popcorn Time version 0.4.7, consider disabling the 'nodeIntegration' configuration as a temporary workaround to minimize the risk of exploitation. Restrict access to the 'Movies API Server(s)' field in the settings page until a patch is available. Avoid using the 'settings' page with the 'nodeIntegration' configuration enabled until the issue is resolved.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾