CVE-2023-36106
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
CVE-2023-36106 describes an incorrect access control vulnerability in powerjob version 4.3.2 and earlier, allowing remote attackers to obtain sensitive information via the querying interface using the appId parameter to /container/list.
Risk Assessment
Organizations may be exposed to the disclosure of confidential data, potentially leading to further attacks or privacy breaches.
Recommendation
It is recommended to upgrade to the latest version of powerjob to mitigate this vulnerability and implement additional access control mechanisms.
Other vulnerabilities in powerjob
See all- CVE-2023-37754Critical
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.
- CVE-2026-5739High
A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2 affecting the function GroovyEvaluator.evaluate in the file /openApi/addWorkflowNode of the OpenAPI Endpoint component. Manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem through an issue report but has not responded yet.
- CVE-2026-5736High
In PowerJob 5.1.0/5.1.1/5.1.2, the detailPlus endpoint in InstanceController.java is vulnerable to SQL injection via the customQuery argument. Remote exploitation is possible. The project was notified but has not responded.
Original NVD description (English source)
An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.