{"id":"CVE-2020-23814","published":"2020-09-03T16:58:11Z","modified":"2024-08-04T15:05:10Z","title":"Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.01434,"percentile":0.7306,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2024-05-10","exploitedFirstSeen":"2024-05-10","ransomware":false,"evidence":[{"url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","date":"2024-05-10"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"GitHub - nautilus-aqua/Kinsing-Indication-of-Compromise: This repo contains indication of compromise of Kinsing threat actor that were collected over a period of few years","url":"https://otx.alienvault.com/pulse/67ba26921050c137f83c3b8d","created":"2025-02-22"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.ccsq8.com/issues.html","tags":["x_refsource_MISC"]},{"url":"https://github.com/xuxueli/xxl-job/issues/1866","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"com.xuxueli:xxl-job","vulnerableRanges":["<2.3.0"],"patched":["2.3.0"],"from":["GHSA-pqqj-299w-wf53"],"provenance":"source"}],"advisories":[{"id":"GHSA-pqqj-299w-wf53","url":"https://github.com/advisories/GHSA-pqqj-299w-wf53","severity":"MODERATE","ecosystem":"Maven","package":"com.xuxueli:xxl-job","vulnerableRanges":["<2.3.0"],"patched":["2.3.0"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-4808","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-4808","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2020-23814","name":"XXL-JOB v2.2.0 — Stored Cross Site Scripting","severity":"medium","path":"http/cves/2020/CVE-2020-23814.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-23814.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2020-09-03","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-23814","provenance":"source"},{"date":"2024-05-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":55.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 904 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.61,"detail":"percentile 0.7306"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-com-xuxueli-xxl-job-core-cve-2020-23814","children":[{"from":"CVE-2020-23814","to":"CVE-2022-36157","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.xuxueli:xxl-job","fromFixed":"2.3.0","toFixed":"2.4.0","daysApart":715},{"kind":"same-code","provenance":"machine","files":["xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobGroupController.java"],"commits":["https://github.com/xuxueli/xxl-job/commit/227628567354d3c156951009d683c6fec3006e0e","https://github.com/xuxueli/xxl-job/commit/730c1066b80e8ab44503ed34ced19ef8e0471fec"],"basis":"shared function","functions":["save"]}]},{"from":"CVE-2020-23814","to":"CVE-2024-42681","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java"],"commits":["https://github.com/xuxueli/xxl-job/commit/227628567354d3c156951009d683c6fec3006e0e","https://github.com/xuxueli/xxl-job/commit/a2dc9011310628f3e18c3a5095e7e6a946d017bd"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-23814","published":"2020-09-03","fixed":"2.3.0","kev":false},{"cve":"CVE-2022-36157","published":"2022-08-19","fixed":"2.4.0","kev":false}],"package":"Maven:com.xuxueli:xxl-job"}}