GitHub Advisoryadvisory · Maven

GHSA-m54f-rp6r-rrrm XXL-JOB contains a Command execution vulnerability in background tasks

CRITICAL Published 2022-09-29 Modified 2024-05-07 Official page ↗
Aliases
CVE-2022-40929
Ecosystem
Maven
Packages
com.xuxueli:xxl-job-core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2022-09-30

Affected packages

• Maven com.xuxueli:xxl-job-core: <= 2.2.0 (no fix yet)

Description

XXL-JOB versions 2.2.0 and prior contain a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).

Related

Alias · CVE (1)

  • CVE-2022-40929 XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References