PT-2022-7182 · Opencats · Opencats

Published 2022-10-19 · Updated 2025-09-24 · CVE-2022-43016

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenCATS version 0.9.6

Description The issue is related to a reflected cross-site scripting (XSS) vulnerability in the callback component of OpenCATS. This vulnerability can be exploited by a remote attacker to conduct cross-site scripting attacks, potentially allowing them to execute malicious scripts on the victim's browser. The vulnerability is associated with the failure to protect the web page structure.

Recommendations For OpenCATS version 0.9.6, consider disabling the callback component as a temporary workaround until a patch is available. Restrict access to the callback component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08738

CVE-2022-43016

Affected Products

Opencats

References · 10

• 🔥❌ https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_callback.md · Exploit, Deleted
• 🔥 https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43016 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-43016 · Security Note
• https://bdu.fstec.ru/vul/2023-08738 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43016 · Vendor Advisory
• https://securityforeveryone.com/tools/opencats-0-9-6-cross-site-scripting-cve-2022-43016 · Note
• https://t.me/cveNotify/136344 · Telegram Post
• https://vuldb.com/?id.211890 · Note
• https://t.me/cveNotify/135520 · Telegram Post
• https://t.me/cibsecurity/51819 · Telegram Post