A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\com\xxl\job\executor\service\jobhandler\SampleXxlJob.java. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
References:GSA_kwCzR0hTQS1mOHZ3LTh2Z2gtMjJyOc4ABKRv
XXL-JOB is vulnerable to SSRF attacks
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| maven:com.xuxueli:xxl-job-core | <= 3.1.1 | No known fixed version | |
Affected Version RangesAll affected versions1.4.1, 1.4.2, 1.5.0, 1.5.1, 1.5.2, 1.6.0, 1.6.1, 1.6.2, 1.7.0, 1.7.1, 1.7.2, 1.8.0, 1.8.1, 1.8.2, 1.9.0, 1.9.1, 1.9.2, 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.1.1, 2.1.2, 2.2.0, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.4.2, 2.5.0, 3.0.0, 3.1.0, 3.1.1 |
|||