GitHub Advisoryadvisory · Maven

GHSA-83w4-x5w9-hf4h XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)

HIGH Published 2022-11-17 Modified 2025-07-18 Official page ↗

Aliases: CVE-2022-43183
Ecosystem: Maven
Packages: com.xuxueli:xxl-job-core
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-918
Reviewed: 2022-11-21

Affected packages

• Maven com.xuxueli:xxl-job-core: < 2.4.0 → fixed in 2.4.0

Description

XXL-Job before v2.4.0 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.

Related

Alias · CVE (1)

CVE-2022-43183 XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java. vulnerability

Weakness · CWE (1)

CWE-918 Server-Side Request Forgery weakness

References