CVE-2022-48012

MEDIUMNuclei

OpenCATS 0.9.7 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-48012 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 28, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMOpenCATS 0.9.7 - Cross-Site ScriptingCVSS 6.1

OpenCATS 0.9.7 contains a cross-site scripting vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information.

Remediation

To mitigate this vulnerability, it is recommended to apply the latest security patches or upgrade to a newer version of OpenCATS that addresses the XSS vulnerability.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscvecve2022xssopencatsauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:opencats:opencats:0.9.7:*:*:*:*:*:*:*
Shodan: title:"opencats"
Shodan: http.title:"opencats"
FOFA: title="opencats"
Google: intitle:"opencats"
https://github.com/Sakura-501/Opencats-0.9.7-Vulnerabilities https://github.com/Sakura-501/Opencats-0.9.7-Vulnerabilities/blob/main/Opencats-0.9.7-Reflected%20XSS%20in%20onChangeTag.md https://nvd.nist.gov/vuln/detail/CVE-2022-48012

Source: ProjectDiscovery

References

3