# com.xuxueli:xxl-job (Maven) vulnerabilities

11 known vulnerabilities (3 high, 2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/com.xuxueli/xxl-job

## Advisories (11)

### [CVE-2024-24113](https://cve.now/CVE-2024-24113): xxl-job =\< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.

- Severity: High 8.8
- Published: Feb 8, 2024
- Affected: through 2.4.2.

### [CVE-2020-24922](https://cve.now/CVE-2020-24922): Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to…

- Severity: Unrated
- Published: Aug 11, 2023
- Affected: through 2.2.0.

### [CVE-2023-33779](https://cve.now/CVE-2023-33779): A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a…

- Severity: High 8.8
- Published: May 26, 2023
- Affected: through 2.4.1.

### [CVE-2023-26120](https://cve.now/CVE-2023-26120): This affects all versions of the package com.xuxueli:xxl-job.

- Severity: Medium 5.4
- Published: Apr 10, 2023
- Affected: through 2.4.0.

### [CVE-2023-27087](https://cve.now/CVE-2023-27087): Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the…

- Severity: High 7.5
- Published: Mar 21, 2023
- Affected: from 2.2.0, through 2.3.1.

### [CVE-2023-0674](https://cve.now/CVE-2023-0674): XXL-JOB New Password updatePwd cross-site request forgery

- Severity: Medium 4.3
- Published: Feb 4, 2023
- Affected: through 2.3.1.

### [CVE-2022-36157](https://cve.now/CVE-2022-36157): XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low…

- Severity: Unrated
- Published: Aug 19, 2022
- Affected: fixed in 2.4.0.

### [CVE-2022-29770](https://cve.now/CVE-2022-29770): XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.

- Severity: Unrated
- Published: Jun 3, 2022
- Affected: through 2.3.1.

### [CVE-2022-29002](https://cve.now/CVE-2022-29002): A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component…

- Severity: Unrated
- Published: May 23, 2022
- Affected: through 2.3.0.

### [CVE-2020-23814](https://cve.now/CVE-2020-23814): Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via…

- Severity: Unrated
- Published: Sep 3, 2020
- Affected: fixed in 2.3.0.

### [CVE-2020-23811](https://cve.now/CVE-2020-23811): xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.

- Severity: Unrated
- Published: Sep 3, 2020
- Affected: through 2.2.0.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/com.xuxueli:xxl-job
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.