CVE-2022-42750

2022-11-0300:00:00

Fluid Attacks

www.cve.org

candidats

external attacker

cookie theft

user validation

file upload

8.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "CandidATS",
    "versions": [
      {
        "version": "3.0.0",
        "status": "affected"
      }
    ]
  }
]

References

candidats.net/

fluidattacks.com/advisories/castles/