GitHub Advisoryadvisory · Maven

GHSA-49mj-77q5-qw5g Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

MEDIUM Published 2022-05-17 Modified 2025-09-23 Official page ↗
Aliases
CVE-2017-12882
Ecosystem
Maven
Packages
org.springframework.batch:spring-batch-admin-manager
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-09-23

Affected packages

• Maven org.springframework.batch:spring-batch-admin-manager: < 1.3.0.RELEASE → fixed in 1.3.0.RELEASE

Description

Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.

Related

Alias · CVE (1)

  • CVE-2017-12882 Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References