Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

MITTEL 5.4CVE-2017-12882 · GHSA-49mj-77q5-qw5g · Published 18/08/2017 · updated 17/06/2026

Kurz gesagt

CVE-2017-12882 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in org.springframework.batch:spring-batch-admin-manager, spring batch admin (spring batch admin project).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.64%, höher als bei 51.1% aller Schwachstellen.
Abhilfe: auf 1.3.0.RELEASE oder neuer aktualisieren.

Package	Affected versions	Patched versions
org.springframework.batch:spring-batch-admin-manager Maven	`< 1.3.0.RELEASE`	`1.3.0.RELEASE`
spring batch admin spring_batch_admin_project	`≤ 1.2.1`	No fix yet

Description

Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.

NVD description

Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.

References

nvd.nist.gov/vuln/detail/CVE-2017-12882 · ADVISORY
spring-attic/spring-batch-admin · PACKAGE
openwall.com/lists/oss-security/2017/08/16/5 · WEB
securityfocus.com/bid/100410 · Third Party Advisory

Weitere Schwachstellen in org.springframework.batch:spring-batch-admin-manager

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Kurz gesagt

CVE-2017-12882 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in org.springframework.batch:spring-batch-admin-manager, spring batch admin (spring batch admin project).

Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.64%, höher als bei 51.1% aller Schwachstellen.

Abhilfe: auf 1.3.0.RELEASE oder neuer aktualisieren.

Package

Affected versions

Patched versions

org.springframework.batch:spring-batch-admin-manager

Maven

< 1.3.0.RELEASE

1.3.0.RELEASE

spring batch admin

spring_batch_admin_project

≤ 1.2.1

No fix yet

Description

Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.

NVD description

Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.

Weitere Schwachstellen in org.springframework.batch:spring-batch-admin-manager

Alle anzeigen →