CVE-2022-42749

CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

Affected

CandidATS

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

1.16% chance of exploitation in the next 30 days, 67th percentile

Nuclei

medium · CWE-79

Published

2022-11-03

Updated

2025-05-05

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42749.yaml

Security advisories

• https://fluidattacks.com/advisories/modestep
• https://candidats.net

References

• CVE Record
• NVD entry