erzhongxmu JEEWMS JeecgListDemoController.java doAdd 跨站脚本漏洞

Successful exploitation of CVE-2026-3028 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session on the JEEWMS application. This can lead to a variety of malicious actions, including session hijacking, credential theft, and defacement of the application's user interface. An attacker could potentially gain access to sensitive data stored within JEEWMS, such as user information, financial records, or other confidential data. The impact is amplified if JEEWMS is integrated with other systems, as the attacker could potentially use this vulnerability as a stepping stone to compromise other parts of the infrastructure.

1. 已保留2026-02-23
2. 发布日期2026-02-23
3. 修改日期2026-02-25
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-3028 is to upgrade JEEWMS to a patched version. Unfortunately, a fixed version is not currently specified. As a temporary workaround, implement strict input validation and sanitization on the Name parameter within the doAdd function. This can be achieved by using a web application firewall (WAF) with XSS protection rules or by implementing custom filtering logic. Additionally, consider implementing Content Security Policy (CSP) to restrict the sources from which scripts can be executed, limiting the potential impact of a successful XSS attack. Regularly review and update JEEWMS configuration to ensure best practices are followed.