description: CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.
problem types: Cross-site request forgery (CSRF)
affected:
{
vendor: n/a
product: CandidATS
versions:
version: 3.0.0, status: affected
}