CVE-2022-42751

2022-11-0300:00:00

Fluid Attacks

www.cve.org

candidats

privilege elevation

csrf

administrator permissions

8.8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

46.9%

JSON

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "CandidATS",
    "versions": [
      {
        "version": "3.0.0",
        "status": "affected"
      }
    ]
  }
]

References

candidats.net/

fluidattacks.com/advisories/londra/