Lucene search
HistoryApr 10, 2023 - 5:15 a.m.
CVE-2023-26120
vulnerability
html upload
com.xuxueli:xxl-job
xxl-job package
user update
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
5.7
Confidence
High
EPSS
0.002
Percentile
52.7%
This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update.
Affected configurations
Node
xuxuelixxl-job
Related
cve
cve
CVE-2023-26120
2023-04-10 05:15:07
prion
prion
Hardcoded credentials
2023-04-10 05:15:00
veracode
veracode
Cross-Site Scripting (XSS)
2023-04-19 05:31:37
osv
osv
XXL-JOB vulnerable to Cross-site Scripting
2023-04-10 06:30:16
cvelist
cvelist
CVE-2023-26120
2023-04-10 05:00:01
github
github
XXL-JOB vulnerable to Cross-site Scripting
2023-04-10 06:30:16
CVSS3
6.1
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AI Score
5.7
Confidence
High
EPSS
0.002
Percentile
52.7%
Related for NVD:CVE-2023-26120