Cross Site Scripting Vulnerability in XXL Job Admin by Xuxueli
CVE-2023-48088

5.4MEDIUM

Key Information:

Vendor

Xuxueli

Status
Xxl-job
Vendor
CVE Published:
15 November 2023

What is CVE-2023-48088?

XXL Job Admin version 2.4.0 is susceptible to Cross Site Scripting (XSS) attacks through the endpoint /xxl-job-admin/joblog/logDetailPage. This vulnerability allows attackers to inject malicious scripts into the web interface, potentially compromising user sessions, stealing sensitive information, or performing unauthorized actions. Proper validation and sanitization measures should be implemented to mitigate this risk.

References

https://github.com/xuxueli/xxl-job/issues/3329

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.