| 标题 | Cross-site request forgery exists at the password modification of xxl-job |
|---|
| 描述 | A relatively serious vulnerability was found in xxl-job because it involves user password modification and login. In this system, there is a function to modify the password. When changing the password, the person who changed the password is not verified. Only the cookie of the system exists locally can be modified. A malicious user can use the cross-site request forgery vulnerability to modify the password by clicking the malicious link.consultation:https://github.com/boyi0508/xxl-job-explain/blob/main/README.md |
|---|
| 用户 | boyi (UID 40109) |
|---|
| 提交 | 2023-02-03 02時17分 (4 年前) |
|---|
| 管理 | 2023-02-06 15時44分 (4 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 220196 [XXL-JOB 2.3.1 New Password /user/updatePwd 跨网站请求伪造] |
|---|
| 积分 | 0 |
|---|