CVE-2022-43018

Deeper analysis

OpenCATS version 0.9.6 contains a reflected cross-site scripting vulnerability, tracked as CVE-2022-43018 and assigned CWE-79, that is triggered through the email parameter in the Check Email function. The flaw carries a CVSS 3.1 score of 6.1, reflecting network attack vector, low complexity, no required privileges, and required user interaction with changed scope.

An unauthenticated attacker can supply a crafted email value that is reflected back to a victim who follows a malicious link, allowing execution of arbitrary script in the context of the application and limited impact on confidentiality and integrity. The provided references consist of public proof-of-concept code and a detailed write-up demonstrating the injection point, but contain no information on official patches or mitigation steps from the vendor.

EPSS for the CVE rose from a low baseline to a peak of 0.1241 before receding to the current value of 0.0245, indicating a period of increased exploitation interest after disclosure. Public exploit artifacts remain available on GitHub for researchers examining the issue.