Description

XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account.

Remediation

References

https://github.com/Richard-Muzi/vulnerability/issues/1

Related Vulnerabilities

CVE-2020-36188 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2021-23449 Vulnerability in npm package vm2

CVE-2021-4264 Vulnerability in maven package org.webjars.bower:dustjs-linkedin

CVE-2019-18954 Vulnerability in npm package pomelo

CVE-2022-0086 Vulnerability in npm package uppy

Severity

Critical

Classification

CWE-269 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Issue Tracking Third Party Advisory