Threats affecting pkg:github/OpenCATS

OpenCATS versions 0.10.0 up to but not including 0.12.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows a low-privileged authenticated user to inject malicious HTML or JavaScript code into various name or title fields, which are then rendered unsanitized in the 'Recent' navigation panel on nearly every page. When other users, including administrators, view these records, the injected script executes in their sessions, potentially enabling session hijacking and privilege escalation. The vulnerability is fixed in OpenCATS version 0.12.0.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user's events, including non-public ones restricted to their owner.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregate ethnicity, veteran, gender and disability statistics.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported candidate, company, and contact records.

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any savedListID to alter or delete any saved list site-wide.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any recipient with a spoofed From address.

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and pipeline history for candidates, contacts and companies.

OpenCATS version 0.10.0 contains a vulnerability in the processLogin function of the Career Portal component that improperly restricts excessive authentication attempts. This flaw allows remote attackers to attempt multiple authentications with a high degree of complexity and difficulty. The project maintainer has released a patch that changes authentication to require CAPTCHA completion and maintains authenticated sessions server-side, removing reliance on client-side cookies. Rate limiting is recommended to be implemented outside the application at the network or proxy layer.