CVE-2017-12881 Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality
Remote attackers can hijack user authentication to submit arbitrary requests, including file uploads, in Spring Batch Admin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-12881?
CVE-2017-12881 is a high-severity vulnerability in n/a, published on 18 Aug 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability.
Weakness: CWE-352
Which versions are affected by CVE-2017-12881?
2 open source packages ship an affected version, including org.springframework.batch:spring-batch-admin-manager. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.batch:spring-batch-admin-manager Maven | All versions | 1.3.0.RELEASE |
org.springframework.batch:spring-batch-admin-manager Maven | All versions | 1.3.0.RELEASE |
Products include Spring Batch Admin Project Spring Batch Admin.
How do I fix CVE-2017-12881?
Upgrade org.springframework.batch:spring-batch-admin-manager to 1.3.0.RELEASE or later.
Is CVE-2017-12881 being exploited?
There is no known exploitation of CVE-2017-12881 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-274r-p6v6-fhh4.