GitHub Advisoryadvisory · Maven

GHSA-2v42-xp3j-47m4 Xuxueli xxl-job template injection vulnerability

LOW Published 2024-04-06 Modified 2025-05-23 Official page ↗
Aliases
CVE-2024-3366
Ecosystem
Maven
Packages
com.xuxueli:xxl-job-core
Severity
Low
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-502, CWE-74
Reviewed
2024-04-08

Affected packages

• Maven com.xuxueli:xxl-job-core: <= 2.4.0 (no fix yet)

Description

A vulnerability classified as problematic was found in Xuxueli xxl-job version 2.4.0. This vulnerability affects the function `deserialize` of the file `com/xxl/job/core/util/JdkSerializeTool.java` of the component `Template Handler`. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.

Related

Alias · CVE (1)

  • CVE-2024-3366 A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. vulnerability

Weakness · CWE (2)

  • CWE-502 Deserialization of Untrusted Data weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References