PT-2022-7192 · Opencats · Opencats

Published 2022-10-19 · Updated 2025-09-24 · CVE-2022-43017

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenCATS version 0.9.6

Description The issue is related to the indexFile component of the OpenCATS personnel management system, which fails to protect the web page structure. This can be exploited by a remote attacker to conduct cross-site scripting (XSS) attacks.

Recommendations For OpenCATS version 0.9.6, update to a version that includes a fix for this issue, as using the indexFile component in its current state may allow for XSS attacks. As a temporary workaround, consider restricting access to the indexFile component to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-08996

CVE-2022-43017

Affected Products

Opencats

References · 7

• 🔥 https://github.com/hansmach1ne/CVE-portfolio/tree/main/CVE-2022-43017 · Exploit
• 🔥❌ https://github.com/hansmach1ne/opencats_zero-days/blob/main/XSS_in_indexFile.md · Exploit, Deleted
• https://bdu.fstec.ru/vul/2023-08996 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-43017 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43017 · Vendor Advisory
• https://t.me/cveNotify/136345 · Telegram Post
• https://t.me/cveNotify/135521 · Telegram Post