Medium · 5.4 CVE-2017-12882 EUVD-2017-4406GHSA-49mj-77q5-qw5g

Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

Published Aug 18, 2017 · Updated Aug 5, 2024 · Assigned by mitre

Package: org.springframework.batch:spring-batch-admin-manager Ecosystem: Maven

Description

Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.springframework.batch:spring-batch-admin-manager	< 1.3.0.RELEASE	1.3.0.RELEASE	GHSA-49mj-77q5-qw5g

References

[oss-security] 20170816 CVE-2017-12882, CVE-2017-12881: Stored XSS and CSRF on Spring Batch Admin before 1.3.0 mailing-list
100410 vdb-entry