Description

XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.

Remediation

References

https://github.com/Richard-Muzi/vulnerability/issues/1

Related Vulnerabilities

CVE-2020-15092 Vulnerability in npm package @knight-lab/timelinejs

CVE-2022-37257 Vulnerability in npm package steal

CVE-2021-32803 Vulnerability in npm package tar

CVE-2022-43183 Vulnerability in maven package com.xuxueli:xxl-job

CVE-2022-41854 Vulnerability in maven package org.yaml:snakeyaml

Severity

Critical

Classification

CWE-269 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Third Party Advisory