XXL-JOB 2.3.1 New Password /user/updatePwd cross-site request forgery

A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery. Using CWE to declare the problem leads to CWE-352. The weakness was released 02/04/2023. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-0674. The attack may be launched remotely. Technical details are available. Furthermore, there is an exploit available. The exploit has been disclosed to the public and may be used. The current price for an exploit might be approx. USD $0-$5k at the moment. It is declared as proof-of-concept. The exploit is available at github.com. As 0-day the estimated underground price was around $0-$5k. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

147

Field

vulnerability_cvss3_meta_tempscore2
vulnerability_cvss3_meta_basescore2
vulnerability_cvss3_cna_basescore1
vulnerability_cvss3_nvd_basescore1
vulnerability_cvss2_nvd_basescore1

Commit Conf

90%35
70%25
50%10

Approve Conf

90%35
70%25
80%10
IDCommitedUserFieldChangeRemarksAcceptedStatusC
1376228103/05/2023VulD...cvss3_cna_basescore4.3see CVSS documentation03/05/2023accepted
90
1376228003/05/2023VulD...cvss3_nvd_basescore6.5nist.gov03/05/2023accepted
90
1376227903/05/2023VulD...cvss2_nvd_basescore5.0nist.gov03/05/2023accepted
90
1376227803/05/2023VulD...cvss3_meta_tempscore4.9see CVSS documentation03/05/2023accepted
90
1376227703/05/2023VulD...cvss3_meta_basescore5.0see CVSS documentation03/05/2023accepted
90
1376227603/05/2023VulD...cve_cnaVulDBnvd.nist.gov03/05/2023accepted
70
1376227503/05/2023VulD...cvss3_cna_aNnvd.nist.gov03/05/2023accepted
70
1376227403/05/2023VulD...cvss3_cna_iLnvd.nist.gov03/05/2023accepted
70
1376227303/05/2023VulD...cvss3_cna_cNnvd.nist.gov03/05/2023accepted
70
1376227203/05/2023VulD...cvss3_cna_sUnvd.nist.gov03/05/2023accepted
70
1376227103/05/2023VulD...cvss3_cna_uiRnvd.nist.gov03/05/2023accepted
70
1376227003/05/2023VulD...cvss3_cna_prNnvd.nist.gov03/05/2023accepted
70
1376226903/05/2023VulD...cvss3_cna_acLnvd.nist.gov03/05/2023accepted
70
1376226803/05/2023VulD...cvss3_cna_avNnvd.nist.gov03/05/2023accepted
70
1376226703/05/2023VulD...cvss2_nvd_aiNnvd.nist.gov03/05/2023accepted
70
1376226603/05/2023VulD...cvss2_nvd_iiPnvd.nist.gov03/05/2023accepted
70
1376226503/05/2023VulD...cvss2_nvd_ciNnvd.nist.gov03/05/2023accepted
70
1376226403/05/2023VulD...cvss2_nvd_auNnvd.nist.gov03/05/2023accepted
70
1376226303/05/2023VulD...cvss2_nvd_acLnvd.nist.gov03/05/2023accepted
70
1376226203/05/2023VulD...cvss2_nvd_avNnvd.nist.gov03/05/2023accepted
70

50 more entries are not shown

Do you need the next level of professionalism?

Upgrade your account now!