com.xuxueli:xxl-job (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package com.xuxueli:xxl-job, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (11)

• CVE-2024-24113 — CVSS 8.8 (high): xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.
• CVE-2020-24922 — CVSS 8.8 (high): Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to…
• CVE-2022-29002 — CVSS 8.8 (high): A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component…
• CVE-2022-36157 — CVSS 8.8 (high): XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low…
• CVE-2023-33779 — CVSS 8.8 (high): A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a…
• CVE-2020-23811 — CVSS 7.5 (high): xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.
• CVE-2023-27087 — CVSS 7.5 (high): Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the…
• CVE-2020-23814 — CVSS 6.1 (medium): Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1)…
• CVE-2023-26120 — CVSS 5.4 (medium): This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add…
• CVE-2022-29770 — CVSS 5.4 (medium): XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.
• CVE-2023-0674 — CVSS 4.3 (medium): A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality…