CVE-2022-40929 - XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks

Back Back to CVE browser

CRITICAL

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks

Published Sep 28, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 1.58%

Description

XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (3)

https://github.com/advisories/GHSA-m54f-rp6r-rrrm
Advisory
https://github.com/xuxueli/xxl-job/issues/2979
ExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40929

Link	Providers	Tags
https://github.com/advisories/GHSA-m54f-rp6r-rrrm		Advisory
https://github.com/xuxueli/xxl-job/issues/2979		ExploitIssue TrackingThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-40929