GitHub Advisoryadvisory · Maven

GHSA-4cj8-779h-r25h Cross-site Scripting in Pivotal Spring Batch Admin

MEDIUM Published 2022-05-13 Modified 2024-01-05 Official page ↗
Aliases
CVE-2018-1229
Ecosystem
Maven
Packages
org.springframework.batch:spring-batch-admin-manager
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-05

Affected packages

• Maven org.springframework.batch:spring-batch-admin-manager: <= 2.0.0.M1 (no fix yet)

Description

Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.

Related

Alias · CVE (1)

  • CVE-2018-1229 Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References