Design/Logic Flaw

2022-11-0318:15:00

PRIOn knowledge base

www.prio-n.com

candidats

cookie theft

unvalidated files

8.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user.

CPENameOperatorVersion
candidatseq3.0.0

CPE	Name	Operator	Version
	candidats	eq	3.0.0

References

candidats.net/

fluidattacks.com/advisories/castles/