Please answer some questions before submitting your issue. Thanks!
Which version of XXL-JOB do you using?
2.4.0
XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks.
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVSSv2:
Base Score: HIGH (9.8)
Vector: /AV:N/AC:L/Au:/C:H/I:H/A:H
References:
OSSINDEX - [CVE-2022-40929] CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40929
OSSIndex - GHSA-m54f-rp6r-rrrm
OSSIndex - #2979
Vulnerable Software & Versions (OSSINDEX):
cpe:2.3:a:com.xuxueli:xxl-job-core:2.4.0:::*:::*:*
3条答案
按热度按时间iq3niunx1#
请问这个漏洞应该怎么处理才能解决，并且不被安全扫描出来
tquggr8v2#
请问这个漏洞应该怎么处理才能解决，并且不被安全扫描出来
你把jar重新编译一下, 或者把jar包换个名字, 它就扫描不出来了
soat7uwm3#
请问这个漏洞应该怎么处理才能解决，并且不被安全扫描出来
你把jar重新编译一下, 或者把jar包换个名字, 它就扫描不出来了
哈哈哈，这是不是那句古话叫”掩耳盗铃“