{"id":"CVE-2020-29204","published":"2020-12-27T05:36:08Z","modified":"2024-08-04T16:48:01Z","title":"XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via…","vendor":null,"product":null,"tier":"tail","description":{"text":"XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00893,"percentile":0.59429,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/xuxueli/xxl-job/issues/2083","tags":["x_refsource_MISC"]}],"priority":{"score":11.9,"factors":[{"name":"EPSS percentile","points":11.89}]},"affected":[{"ecosystem":"Maven","package":"com.xuxueli:xxl-job-core","vulnerableRanges":["<2.3.0"],"patched":["2.3.0"],"from":["GHSA-wc73-w5r9-x9pc"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-2265","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-com-xuxueli-xxl-job-core-cve-2020-23814","children":[{"from":"CVE-2020-29204","to":"CVE-2022-36157","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobGroupController.java"],"commits":["https://github.com/xuxueli/xxl-job/commit/227628567354d3c156951009d683c6fec3006e0e","https://github.com/xuxueli/xxl-job/commit/730c1066b80e8ab44503ed34ced19ef8e0471fec"],"basis":"shared function","functions":["save"]}]},{"from":"CVE-2020-29204","to":"CVE-2024-42681","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java"],"commits":["https://github.com/xuxueli/xxl-job/commit/227628567354d3c156951009d683c6fec3006e0e","https://github.com/xuxueli/xxl-job/commit/a2dc9011310628f3e18c3a5095e7e6a946d017bd"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-29204","published":"2020-12-27","fixed":"2.3.0","kev":false},{"cve":"CVE-2022-43183","published":"2022-11-17","fixed":"2.4.0","kev":false,"link":{"from":"CVE-2020-29204","to":"CVE-2022-43183","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:com.xuxueli:xxl-job-core","fromFixed":"2.3.0","toFixed":"2.4.0","daysApart":690}]}},{"cve":"CVE-2024-42681","published":"2024-08-15","fixed":"2.4.2","kev":false}],"package":"Maven:com.xuxueli:xxl-job-core"}}