org.springframework.batch vulnerabilities

Products

• org.springframework.batch/spring-batch-admin-manager 3
• org.springframework.batch/spring-batch-core 2

Latest org.springframework.batch CVEs

Newest publication first

1. CVE-2020-5411 Jackson Configuration Allows Code Execution with Unknown "Serialization Gadgets"

   Published 2020-06-11

   High·CVSS 8.1 EPSS 1.7%

   When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing en...

2. CVE-2019-3774 Spring Batch XML External Entity Injection (XXE)

   Published 2019-01-18

   Critical·CVSS 9.8

   Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.

3. CVE-2018-1229 Cross-site Scripting in Pivotal Spring Batch Admin

   Published 2018-03-21

   Medium·CVSS 6.1

   Pivotal Spring Batch Admin, all versions, contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been...

4. CVE-2017-12882 Spring Batch Admin vulnerable to Stored Cross-site scripting (XSS) in the file upload functionality

   Published 2017-08-18

   Medium·CVSS 5.4

   Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.

5. CVE-2017-12881 Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality

   Published 2017-08-18

   High·CVSS 8.8

   Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.