GitHub Advisoryadvisory · Maven

GHSA-f8vw-8vgh-22r9 XXL-JOB is vulnerable to SSRF attacks

LOW Published 2025-07-18 Modified 2025-09-13 Official page ↗
Aliases
CVE-2025-7787
Ecosystem
Maven
Packages
com.xuxueli:xxl-job-core
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-918
Reviewed
2025-07-21

Affected packages

• Maven com.xuxueli:xxl-job-core: <= 3.1.1 (no fix yet)

Description

A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Related

Alias · CVE (1)

  • CVE-2025-7787 A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References