CVE-2022-42751

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application

High · published November 3, 2022

CVSS v3.1
8.8
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.0th percentile
Published
2022-11-03T00:00Z
EPSS history
Timeline
  • 03 NOV 00:00Z
    CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application
    cvelistv5