CVE-2020-29204: 
Java vulnerability analysis and mitigation

XXL-JOB 2.2.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Add User functionality that allows attackers to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java (MITRE CVE, NVD). The vulnerability was discovered and disclosed on November 18, 2020.

The vulnerability exists in the UserController.java component of XXL-JOB's admin interface. It allows attackers to bypass an implemented 20-character limit protection mechanism in the Add User functionality. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (NVD).

When successfully exploited, this vulnerability allows attackers to store and execute malicious cross-site scripting payloads in the application, potentially affecting users who access the compromised pages. The impact includes potential information disclosure and unauthorized data modifications within the scope of affected users' browsers (NVD).

The vulnerability can be exploited remotely and requires user interaction. A proof of concept (PoC) has been publicly disclosed in the original issue report (GitHub Issue).