Medium severity · published Mar 21, 2018
CVE-2018-1229
Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature
6.1
CVSS
0.7%
EPSS
No
On KEV
Description
Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SB
Spring Batch Admin · Pivotal Software
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1229
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1229
Third Party Advisory
http://www.securityfocus.com/bid/103462
Vendor Advisory
https://pivotal.io/security/cve-2018-1229
More from Spring Batch Admin
8.8
CVE-2018-1230
Pivotal Spring Batch Admin, all versions, does not contain cross site request forgery protection