CVE-2022-29770: Cross-Site Scripting in XXL-Job
Summary
CVE-2022-29770: Cross site scripting in XXL-job. Affects com.xuxueli:xxl-job versions < 2.3.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XXL-Job is a Maven package that provides job scheduling and management capabilities. It is commonly used in Java applications to automate and manage tasks. The package allows users to define and schedule jobs, monitor their execution, and perform various administrative tasks. However, XXL-Job version 2.3.0 is vulnerable to a stored cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in XXL-Job version 2.3.0 allows an attacker to inject malicious scripts into the application's jobinfo page. This can occur when user-supplied input is not properly sanitized before being displayed to other users. As a result, an attacker can craft a malicious payload that, when executed by a victim user, can lead to unauthorized access, data theft, or other malicious actions. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the affected functionality or restrict access to the vulnerable page. This can be achieved by modifying the application's configuration or implementing access controls to limit user interaction with the jobinfo page.
Conclusion
The XXL-Job package version 2.3.0 is vulnerable to a stored cross-site scripting (XSS) attack. To mitigate the risk, it is crucial to upgrade to the latest version (2.3.1 or later) or apply the provided workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.xuxueli:xxl-job →
FAQ
XXL-Job is a Maven package used for job scheduling and management in Java applications.
A stored XSS vulnerability allows an attacker to inject malicious scripts into a web application, which are then executed by other users.
The vulnerability can lead to unauthorized access, data theft, or other malicious actions performed by an attacker.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
To fix the vulnerability, it is recommended to upgrade to XXL-Job version 2.3.1 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.xuxueli:xxl-job.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
