{"id":"CVE-2020-29204","published":"2020-12-27T05:36:08Z","modified":"2024-08-04T16:48:01Z","title":"XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via…","vendor":null,"product":null,"tier":"tail","description":{"text":"XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00893,"percentile":0.59473,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/xuxueli/xxl-job/issues/2083","tags":["x_refsource_MISC"]}],"priority":{"score":11.9,"factors":[{"name":"EPSS percentile","points":11.89}]},"affected":[{"ecosystem":"Maven","package":"com.xuxueli:xxl-job-core","vulnerableRanges":["<2.3.0"],"patched":["2.3.0"],"from":["GHSA-wc73-w5r9-x9pc"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2265","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-29204","published":"2020-12-27","fixed":"2.3.0","kev":false},{"cve":"CVE-2022-43183","published":"2022-11-17","fixed":"2.4.0","kev":false,"link":{"from":"CVE-2020-29204","to":"CVE-2022-43183","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.xuxueli:xxl-job-core","fromFixed":"2.3.0","toFixed":"2.4.0","daysApart":690}]}},{"cve":"CVE-2024-42681","published":"2024-08-15","fixed":"2.4.2","kev":false}],"package":"Maven:com.xuxueli:xxl-job-core"}}