Description

Spring Batch Admin does not contain Cross Site Request Forgery (CSRF) protection, which may allow an attacker to craft a malicious site that executes requests to Spring Batch Admin.

Affected Spring Products and Versions

Spring Batch Admin:

• 1.0.0.RELEASE - 1.2.1.RELEASE

Mitigation

This vulnerability has not been fixed as Spring Batch Admin has reached its end of life as of January 1, 2018. Spring Cloud Data Flow is the recommended replacement for managing and monitoring Spring Batch jobs going forward.

Credit

The issue was identified and responsibly reported by Wen Bin Kong.

References

• https://docs.spring.io/spring-batch-admin
• https://github.com/spring-projects/spring-batch-admin/blob/master/MIGRATION.md

History

• 2018-03-16: Initial vulnerability report published.
• 2026-07-09: Formatting improvements.