CVE-2022-42749

2022-11-0300:00:00

Fluid Attacks

www.cve.org

candidats

3.0.0

cookie theft

xss

ajax.php

0.001 Low

EPSS

Percentile

40.9%

JSON

CandidATS version 3.0.0 on ‘page’ of the ‘ajax.php’ resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "CandidATS",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.0"
      }
    ]
  }
]

References

candidats.net/

fluidattacks.com/advisories/modestep/

0.001 Low

EPSS

Percentile

40.9%

JSON

Related for CVELIST:CVE-2022-42749