PatchTheCVEcandidats vulnerabilities and fixes
Recent CVEs affecting candidats, with upgrade or downgrade steps. 9 tracked.
candidats has 9 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 0. Most recent: 2022-11-03. Highest priority: CVE-2022-42744 (score 62/100).
- CVE-2022-42751 HIGH 8.8 DOWNGRADE CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application
- CVE-2022-42750 HIGH 8.8 DOWNGRADE CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users
- CVE-2022-42749 MEDIUM 6.1 DOWNGRADE CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie
- CVE-2022-42748 MEDIUM 6.1 DOWNGRADE CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal th
- CVE-2022-42747 MEDIUM 6.1 DOWNGRADE CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cooki
- CVE-2022-42746 MEDIUM 6.1 DOWNGRADE CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the co
- CVE-2022-42745 HIGH 7.5 DOWNGRADE CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server
- CVE-2022-42744 CRITICAL 9.8 DOWNGRADE CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases
- CVE-2022-25228 MEDIUM 6.5 DOWNGRADE CandidATS Version 3.0.0 Beta allows an authenticated user to inject SQL queries in '/index.php?m=settings&a=sh
FAQ
How do I fix candidats vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is candidats being exploited right now?
None of the tracked candidats CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which candidats CVE should I patch first?
CVE-2022-42744 currently ranks highest (62/100): CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases.