Cross-Site Request Forgery (CSRF)

2023-08-1404:12:19

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site request forgery

csrf

xxl-job

arbitrary code execution

privilege escalations

insufficient checks

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

56.6%

JSON

com.xuxueli:xxl-job is vulnerable to Cross-Site Request Forgery (CSRF). The vulnerability exists in xxl-job-admin/user/add, which allows an attacker to use a crafted .html file to cause CSRF attacks due to insufficient checks, resulting in arbitrary code execution and privilege escalations.