PT-2022-19357 · Xxl-Job · Xxl-Job

Hanjianfei1 · Published 2022-05-23 · Updated 2022-06-07 · CVE-2022-29002

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XXL-Job version 2.3.0

Description A Cross-Site Request Forgery (CSRF) issue allows attackers to create administrator accounts via the "/gaia-job-admin/user/add" API endpoint. This enables attackers to gain unauthorized access to the system.

Recommendations For XXL-Job version 2.3.0, consider disabling access to the "/gaia-job-admin/user/add" API endpoint until a patch is available to prevent exploitation of the CSRF issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2022-29002

GHSA-V3C9-W6G2-HJG3

Affected Products

Xxl-Job

References · 7

• 🔥 https://github.com/xuxueli/xxl-job/issues/2821 · Exploit
• https://osv.dev/vulnerability/GHSA-v3c9-w6g2-hjg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29002 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29002 · Vendor Advisory
• https://github.com/xuxueli/xxl-job · Note
• https://t.me/cvenotify/30603 · Telegram Post
• https://t.me/cibsecurity/43194 · Telegram Post