PT-2022-25627 · Xxl-Job · Xxl-Job

Badboycxcc · Published 2022-09-28 · Updated 2024-08-03 · CVE-2022-40929

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions XXL-JOB versions 2.2.0 and prior

Description The issue concerns a Command execution vulnerability in background tasks, which is disputed as it may be an intended use case for running arbitrary Bash scripts on behalf of users.

Recommendations For XXL-JOB versions 2.2.0 and prior, consider restricting the execution of background tasks or limiting the ability to run arbitrary Bash scripts to minimize potential risks until a clearer resolution or guidance is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-40929

GHSA-M54F-RP6R-RRRM

Affected Products

Xxl-Job

References · 8

• 🔥 https://github.com/xuxueli/xxl-job/issues/2979 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40929 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40929 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m54f-rp6r-rrrm · Vendor Advisory
• https://github.com/xuxueli/xxl-job · Note
• https://t.me/cibsecurity/50614 · Telegram Post
• https://t.me/cvenotify/88771 · Telegram Post
• https://t.me/cvenotify/79332 · Telegram Post