Spring Batch Admin Multiple Security Vulnerabilities
BID:100410
CVE-2017-12881 | CVE-2017-12882 |Info
Spring Batch Admin Multiple Security Vulnerabilities
| Bugtraq ID: | 100410 |
| Class: | Unknown |
| CVE: |
CVE-2017-12882 CVE-2017-12881 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 16 2017 12:00AM |
| Updated: | Aug 16 2017 12:00AM |
| Credit: | Wen Bin. |
| Vulnerable: |
Spring Batch Admin 0 |
| Not Vulnerable: |
Spring Batch Admin 1.3.0 |
Discussion
Spring Batch Admin Multiple Security Vulnerabilities
Spring Batch Admin is prone to following security vulnerabilities:
1. An HTML-injection vulnerability
2. A cross-site request forgery vulnerability
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site or steal cookie-based authentication credentials.
Spring Batch Admin prior to 1.3.0 are vulnerable.
Spring Batch Admin is prone to following security vulnerabilities:
1. An HTML-injection vulnerability
2. A cross-site request forgery vulnerability
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site or steal cookie-based authentication credentials.
Spring Batch Admin prior to 1.3.0 are vulnerable.
Exploit / POC
Spring Batch Admin Multiple Security Vulnerabilities
Attackers can use standard, readily available tools to exploit these issues. To exploit cross-site scripting issues, an attacker must entice an unsuspecting victim into following a malicious URI.
Attackers can use standard, readily available tools to exploit these issues. To exploit cross-site scripting issues, an attacker must entice an unsuspecting victim into following a malicious URI.
Solution / Fix
Spring Batch Admin Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Spring Batch Admin Multiple Security Vulnerabilities
References:
References: