xxl-job-admin vulnerable to Remote Code Execution · CVE-2023-48089 · GitHub Advisory Database · GitHub

xxl-job-admin vulnerable to Remote Code Execution

High severity GitHub Reviewed Published Nov 15, 2023 to the GitHub Advisory Database • Updated Nov 21, 2023

Package

com.xuxueli:xxl-job-admin (Maven)

Affected versions

<= 2.4.0

Patched versions

None

Description

xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.

References

Published by the National Vulnerability Database

Nov 15, 2023

Published to the GitHub Advisory Database Nov 15, 2023

Reviewed Nov 15, 2023

Last updated Nov 21, 2023

Severity

High

8.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H