GitHub Advisoryadvisory · Maven

GHSA-v3c9-w6g2-hjg3 Cross-Site Request Forgery in XXL-Job

HIGH Published 2022-05-24 Modified 2022-06-08 Official page ↗
Aliases
CVE-2022-29002
Ecosystem
Maven
Packages
com.xuxueli:xxl-job
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2022-06-08

Affected packages

• Maven com.xuxueli:xxl-job: <= 2.3.0 (no fix yet)

Description

A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.

Related

Alias · CVE (1)

  • CVE-2022-29002 A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References