CVE-2023-48087 xxl-job-admin vulnerable to Insecure Permissions
Attackers can access job log clearing and detail endpoints without proper authorization, allowing unauthorized data modification and disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48087?
CVE-2023-48087 is a medium-severity missing authorization vulnerability in n/a, published on 15 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.
Weakness: CWE-732
Which versions are affected by CVE-2023-48087?
2 open source packages ship an affected version, including com.xuxueli:xxl-job-admin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.xuxueli:xxl-job-admin Maven | All versions to 2.4.0 | None |
com.xuxueli:xxl-job-admin Maven | All versions to 2.4.0 | None |
Products include Xuxueli Xxl-Job.
How do I fix CVE-2023-48087?
No fix has been published for CVE-2023-48087 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-48087 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-48087 exists.
Other vulnerabilities in n/a
- CVE-2022-40929 XXL-JOB contains a Command execution vulnerability in background tasks
- CVE-2024-42681 Improper Preservation of Permissions in xxl-job
- CVE-2024-24113 XXL-JOB vulnerable to Server-Side Request Forgery
- CVE-2023-48089 xxl-job-admin vulnerable to Remote Code Execution
- CVE-2020-24922 xuxueli xxl-job Cross-Site Request Forgery Vulnerability
Sources
Also known as GHSA-3w8r-3jh9-89v9.