CVE-2022-42747

2022-11-0300:00:00

Fluid Attacks

www.cve.org

candidats

xss attack

ajax.php

user input validation

cve-2022-42747

0.001 Low

EPSS

Percentile

40.9%

JSON

CandidATS version 3.0.0 on ‘sortBy’ of the ‘ajax.php’ resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CandidATS",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0"
      }
    ]
  }
]

References

candidats.net/

fluidattacks.com/advisories/modestep/

0.001 Low

EPSS

Percentile

40.9%

JSON

Related for CVELIST:CVE-2022-42747