CVE-2022-42748 - CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users · CoreCVE

Back Back to CVE browser

MEDIUM

CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users

Published Nov 3, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 1.12%

Description

CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.

Affected products

Vendor n/a Product CandidATS Default
unaffected
- Version
  3.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

CandidATS

unaffected

Version	Status	Constraints
3.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://candidats.net/
Product
https://fluidattacks.com/advisories/modestep/
ExploitThird Party Advisory

Link	Providers	Tags
https://candidats.net/		Product
https://fluidattacks.com/advisories/modestep/		ExploitThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Fluid Attacks

Published Nov 3, 2022

Updated May 5, 2025

Reserved Oct 10, 2022

Link CVE-2022-42748

CISA Vulnrichment

Updated May 5, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2022-42748

Severity n/a

Public date n/a

Links CVE-2022-42748