VULNERABILITY INTELLIGENCE

CVE-2022-42751

CVSS score8.8 HIGH

EPSS probability0.54%

CISA KEVNot currently listed

Published2022-11-03

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.

Weakness classification

nvd@nist.gov: CWE-352
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-352

Primary references

help@fluidattacks.com — Broken Link, Product
help@fluidattacks.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Product
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory