GitHub Advisoryadvisory · Maven

GHSA-c352-x843-ggpq XXL-JOB vulnerable to Server-Side Request Forgery

HIGH Published 2024-02-08 Modified 2025-07-18 Official page ↗
Aliases
CVE-2024-24113
Ecosystem
Maven
Packages
com.xuxueli:xxl-job
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2024-02-08

Affected packages

• Maven com.xuxueli:xxl-job: <= 2.4.2 (no fix yet)

Description

xxl-job <= 2.4.2 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.

Related

Alias · CVE (1)

  • CVE-2024-24113 xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References