{"id":"CVE-2022-25229","state":"PUBLISHED","title":"Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use ","description":"Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands.","publishedAt":"2022-05-20T11:01:18.000Z","updatedAt":"2024-08-03T04:36:06.674Z","severity":null,"assigner":"Fluid Attacks","products":["n/a Popcorn Time"],"affected":[{"vendor":"n/a","product":"Popcorn Time","versions":[{"version":"0.4.7","status":"affected"}]}],"references":["https://fluidattacks.com/advisories/bowie/","https://github.com/popcorn-official/popcorn-desktop/issues/2491"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:46.971Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/25xxx/CVE-2022-25229.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-25229","state":"PUBLISHED","datePublished":"2022-05-20T11:01:18.000Z","dateUpdated":"2024-08-03T04:36:06.674Z","assignerShortName":"Fluid Attacks","assignerOrgId":"84fe0718-d6bb-4716-a7e8-81a6d1daa869","dateReserved":"2022-02-15T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands."}],"affected":[{"vendor":"n/a","product":"Popcorn Time","versions":[{"version":"0.4.7","status":"affected"}]}],"references":[{"url":"https://fluidattacks.com/advisories/bowie/","tags":["x_refsource_MISC"]},{"url":"https://github.com/popcorn-official/popcorn-desktop/issues/2491","tags":["x_refsource_MISC"]}],"problemTypes":[{"descriptions":[{"description":"XSS to RCE","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"Fluid Attacks","dateUpdated":"2022-05-20T20:13:48.000Z","orgId":"84fe0718-d6bb-4716-a7e8-81a6d1daa869"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"help@fluidattacks.com","ID":"CVE-2022-25229","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Popcorn Time","version":{"version_data":[{"version_value":"0.4.7"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows the 'webpage' to use 'NodeJs' features, an attacker can leverage this to run OS commands."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"XSS to RCE"}]}]},"references":{"reference_data":[{"name":"https://fluidattacks.com/advisories/bowie/","refsource":"MISC","url":"https://fluidattacks.com/advisories/bowie/"},{"name":"https://github.com/popcorn-official/popcorn-desktop/issues/2491","refsource":"MISC","url":"https://github.com/popcorn-official/popcorn-desktop/issues/2491"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://fluidattacks.com/advisories/bowie/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://github.com/popcorn-official/popcorn-desktop/issues/2491","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T04:36:06.674Z"}}]}}}