Patchfirst
Patchfirst
CVE-2020-23814 Public exploit EPSS 1.4%

Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.

Heading is the official description · CVE.org
Breakdown
55.3 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 4 years after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+4 yrs

See the family tree

5 related vulnerabilities in the same code over 4 years. The latest fix listed for xxl-job is 2.4.0.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

  1. This CVECVE-2020-23814Multiple cross-site scripting (XSS) vulnerabilities in xxl-job…3 Sep 2020
  2. same family
    CVE-2020-29204XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the…27 Dec 2020
  3. relatedMedium

    Why these are linked:

    CVE-2022-36157XXL-JOB all versions as of 11 July 2022 are vulnerable to…19 Aug 2022
  4. same family
    CVE-2022-43183XXL-Job before v2.3.1 contains a Server-Side Request Forgery…17 Nov 2022
  5. relatedHigh

    Why these are linked:

    • Fixed one release later2.4.0 → 2.4.2 (com.xuxueli:xxl-job-core)
    • Same code patched: JobLogController.java (machine-matched)commit 9293c61commit a2dc901
    CVE-2024-42681Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a…15 Aug 2024

Fixes in xxl-jobMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.3.0CVE-2020-238143 Sep 2020
  2. 2.4.0CVE-2022-3615719 Aug 2022Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: com.xuxueli:xxl-job.

Mavencom.xuxueli:xxl-jobGHSA-pqqj-299w-wf53

Upgrade to 2.3.0 or later

Set the version to 2.3.0 or later in your pom.xml or build.gradle.

The first fix for CVE-2020-23814. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
All versions before 2.3.02.3.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 1 community threat pulse (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

x_refsource_MISC 2

ccsq8.com/issues.htmlgithub.com/xuxueli/xxl-job/issues/1866
↑ ↓ chooseEnter openEsc close