Cross-Site Request Forgery Vulnerability in Spring Batch Admin by Spring
CVE-2017-12881

8.8HIGH

Key Information:

Vendor

Spring Batch Admin Project

Status
Spring Batch Admin
Vendor
CVE Published:
18 August 2017

What is CVE-2017-12881?

A cross-site request forgery (CSRF) vulnerability exists in Spring Batch Admin prior to version 1.3.0. This vulnerability enables remote attackers to potentially hijack user authentication and issue unauthorized requests. By exploiting this flaw, attackers could manipulate the application's functionalities, including the capability to upload files, leading to unauthorized access and control over the system.

References

http://www.openwall.com/lists/oss-security/2017/08/16/5
mailing-listx_refsource_MLIST
http://www.securityfocus.com/bid/100410
vdb-entryx_refsource_BID

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2017-12881 : Cross-Site Request Forgery Vulnerability in Spring Batch Admin by Spring