CandidATS vulnerabilities
We track 4 vulnerabilities in CandidATS products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2022.
Latest CandidATS vulnerabilities
- 7.5 High severity
CandidATS: Improper Restriction of XML External Entity Reference
CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.
- 9.8 Critical severity
CandidATS: Improper Neutralization of Special Elements used in an SQL Command
CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks.
- 8.8 High severity
CandidATS: Cross-Site Request Forgery
CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.
- 8.8 High severity
CandidATS: Improper Neutralization of Input During Web Page Generation
CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user.