Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

com.xuxueli:xxl-job

11 known vulnerabilities (3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11 · 3 high, 2 medium
Registry
Maven Central

Advisories 11

  • xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.

    Affected: through 2.4.2.

  • Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to…

    Affected: through 2.2.0.

  • A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a…

    Affected: through 2.4.1.

  • CVE-2023-26120Medium 5.4

    This affects all versions of the package com.xuxueli:xxl-job.

    Affected: through 2.4.0.

  • Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the…

    Affected: from 2.2.0, through 2.3.1.

  • CVE-2023-0674Medium 4.3

    XXL-JOB New Password updatePwd cross-site request forgery

    Affected: through 2.3.1.

  • XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low…

    Affected: fixed in 2.4.0.

  • XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.

    Affected: through 2.3.1.

  • A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component…

    Affected: through 2.3.0.

  • Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via…

    Affected: fixed in 2.3.0.

  • xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.

    Affected: through 2.2.0.