Lucene search

[email protected]NVD:CVE-2022-42751

HistoryNov 03, 2022 - 6:15 p.m.

CVE-2022-42751

2022-11-0318:15:17

CWE-352

[email protected]

web.nvd.nist.gov

candidats

privilege elevation

csrf

administrator

account creation

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

46.8%

JSON

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.

Affected configurations

Nvd

Node

auieocandidatsMatch3.0.0-

VendorProductVersionCPE
auieocandidats3.0.0cpe:2.3:a:auieo:candidats:3.0.0:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
auieo	candidats	3.0.0	cpe:2.3:a:auieo:candidats:3.0.0:-::::::

References

candidats.net/

fluidattacks.com/advisories/londra/

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

46.8%

JSON

Related for NVD:CVE-2022-42751

cvelist1 cve1 prion1