GHSA-274r-p6v6-fhh4

Source

https://github.com/advisories/GHSA-274r-p6v6-fhh4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-274r-p6v6-fhh4/GHSA-274r-p6v6-fhh4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-274r-p6v6-fhh4

Aliases

CVE-2017-12881

Published

2022-05-17T01:57:52Z

Modified

2025-09-23T18:57:20Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Spring Batch Admin vulnerable to Cross-site request forgery (CSRF) in the file upload functionality

Details

Cross-site request forgery (CSRF) vulnerability in the Spring Batch Admin before 1.3.0 allows remote attackers to hijack the authentication of unspecified victims and submit arbitrary requests, such as exploiting the file upload vulnerability.

Database specific

{
    "cwe_ids":  [
        "CWE-352"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-09-23T17:39:29Z",
    "nvd_published_at":  "2017-08-18T18:29:00Z",
    "severity":  "HIGH"
}

References

Affected packages

Maven / org.springframework.batch:spring-batch-admin-manager

Package

Name: org.springframework.batch:spring-batch-admin-manager; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.batch/spring-batch-admin-manager

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.3.0.RELEASE

Affected versions

1.*

1.0.0.RELEASE

1.2.0.RELEASE

1.2.1.RELEASE

1.2.2.RELEASE

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-274r-p6v6-fhh4/GHSA-274r-p6v6-fhh4.json"