GitHub Advisoryadvisory · Maven

GHSA-jp5r-4x9q-4vcf xuxueli xxl-job Cross-Site Request Forgery Vulnerability

HIGH Published 2023-08-11 Modified 2023-08-17 Official page ↗
Aliases
CVE-2020-24922
Ecosystem
Maven
Packages
com.xuxueli:xxl-job
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2023-08-11

Affected packages

• Maven com.xuxueli:xxl-job: <= 2.2.0 (no fix yet)

Description

Cross Site Request Forgery (CSRF) vulnerability in `xxl-job-admin/user/add` in xuxueli xxl-job version 2.2.0 allows remote attackers to execute arbitrary code and esclate privileges via crafted .html file.

Related

Alias · CVE (1)

  • CVE-2020-24922 Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References