Insecure Permissions in XXL Job Admin by xuxueli
CVE-2023-48087

5.4MEDIUM

Key Information:

Vendor

Xuxueli

Status
Xxl-job
Vendor
CVE Published:
15 November 2023

What is CVE-2023-48087?

XXL Job Admin version 2.4.0 contains a vulnerability that allows attackers to exploit insecure permissions through specific endpoints, namely /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat. This flaw could lead to unauthorized access or manipulation of job logs, posing a risk to the integrity of the logging process and the sensitive information contained within.

References

https://github.com/xuxueli/xxl-job/issues/3330

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.