{"id":"CVE-2017-12882","details":"Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin before 1.3.0 allows remote authenticated users to inject arbitrary JavaScript or HTML via the file upload functionality.","aliases":["GHSA-49mj-77q5-qw5g"],"modified":"2026-07-08T12:05:50.769638Z","published":"2017-08-18T18:29:03.250Z","references":[{"type":"ADVISORY","url":"http://www.openwall.com/lists/oss-security/2017/08/16/5"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/100410"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/spring-attic/spring-batch-admin","events":[{"introduced":"0"},{"last_affected":"14ea5ca8848b6e383e89408f1e948d467fd3029c"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:spring_batch_admin_project:spring_batch_admin:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"1.2.1"}]}}],"versions":["1.2.1.RELEASE","1.2.0.RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12882.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}