PT-2022-7181 · Opencats · Opencats

Published 2022-10-19 · Updated 2025-09-24 · CVE-2022-43014

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenCATS version 0.9.6

Description The issue is related to a reflected cross-site scripting (XSS) vulnerability. This vulnerability can be exploited via the joborderID parameter, potentially allowing a remote attacker to conduct cross-site scripting attacks. The vulnerability is associated with the lack of protection measures for the web page structure in the OpenCATS recruitment process management system.

Recommendations For OpenCATS version 0.9.6, consider restricting access to the joborderID parameter to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the joborderID parameter in affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08737

CVE-2022-43014

Affected Products

Opencats

References · 10

• 🔥❌ https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_joborderID.md · Exploit, Deleted
• 🔥 https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43014 · Exploit
• https://bdu.fstec.ru/vul/2023-08737 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-43014 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43014 · Vendor Advisory
• https://vuldb.com/?id.211888 · Note
• https://github.com/advisories/GHSA-7q2w-qxwp-wgj6 · Note
• https://t.me/cveNotify/135518 · Telegram Post
• https://t.me/cveNotify/136342 · Telegram Post
• https://t.me/cibsecurity/51828 · Telegram Post