GHSA-4j2p-x79m-jcj8
XXL-JOB vulnerable to Cross-site Scripting
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | com.xuxueli:xxl-job | <= 2.4.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
XXL-JOB (`com.xuxueli:xxl-job`) versions 2.4.0 and earlier are vulnerable to cross-site scripting (XSS). An HTML uploaded payload can be executed successfully through `/xxl-job-admin/user/add` and `/xxl-job-admin/user/update`.
References
External links from the advisory. They lead to third-party sites.