GHSA-pqqj-299w-wf53

xxl-job Multiple cross-site scripting (XSS) vulnerabilities

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-23814

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.xuxueli:xxl-job	< 2.3.0	2.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-23814 advisory
https://github.com/xuxueli/xxl-job/issues/1866 web
https://github.com/xuxueli/xxl-job/commit/227628567354d3c156951009d683c6fec3006e0e web
https://www.ccsq8.com/issues.html web