CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.
Threat-Mapped Scoring
Score: 0.0
Priority: Unclassified
EPSS
Score: 0.00271 Percentile:
0.50356
CVSS Scoring
CVSS v3.1 Score: 7.5
Severity: HIGH
Mapped CWE(s)
CWE-611
: Improper Restriction of XML External Entity Reference
All CAPEC(s)
CAPEC-221: Data Serialization External Entities Blowup