CVE-2022-42751

Summary

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.

Affected Software

Weaknesses

• Cross-site request forgery (CSRF)

ADP Enrichment

CVE Program Container

Additional References

• https://fluidattacks.com/advisories/londra/
• https://candidats.net/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

References

• https://fluidattacks.com/advisories/londra/
• https://candidats.net/

• ←Previous
• Next→