6.1med
CVE-2018-1229
Cross-site Scripting in Pivotal Spring Batch Admin
Also known as GHSA-4cj8-779h-r25h
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known
Summary
Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.
Exploit prediction (EPSS)
0.71% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.springframework.batch:spring-batch-admin-manager | <=2.0.0.M1 | no fix listed |
Affected products
- Spring by Pivotal Spring Batch Admin
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- securityfocus.com /bid/103462 · vdb-entry, x_refsource_BID, x_transferred
- pivotal.io /security/cve-2018-1229 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-1229 · advisory
Sources
- CVE List: CVE-2018-1229
- GitHub Advisory: GHSA-4cj8-779h-r25h
- NVD: CVE-2018-1229
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.