GitHub Advisoryadvisory · Maven

GHSA-274r-p6v6-fhh4 Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality

HIGH Published 2022-05-17 Modified 2025-09-23 Official page ↗
Aliases
CVE-2017-12881
Ecosystem
Maven
Packages
org.springframework.batch:spring-batch-admin-manager
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2025-09-23

Affected packages

• Maven org.springframework.batch:spring-batch-admin-manager: < 1.3.0.RELEASE → fixed in 1.3.0.RELEASE

Description

Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability.

Related

Alias · CVE (1)

  • CVE-2017-12881 Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References