VULNERABILITY INTELLIGENCE

CVE-2022-42750

CVSS score8.8 HIGH
EPSS probability1.23%
CISA KEVNot currently listed
Published2022-11-03
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user.

Weakness classification

  • nvd@nist.gov: CWE-79
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Primary references