Homepage
About Snyk

com.xuxueli:xxl-job@2.2.0 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the com.xuxueli:xxl-job package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Privilege Management

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Improper Privilege Management via the Sub-Task ID component. An attacker can execute arbitrary code by manipulating the sub-task ID values.

How to fix Improper Privilege Management?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
  • H
Code Injection

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Code Injection via the /xxl-job-admin/jobcode/save endpoint. A low privileged user can execute arbitrary code on the job executor by injecting it into a cron command.

How to fix Code Injection?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
  • M
Cross-site Scripting (XSS)

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via injection into logs on the /xxl-job-admin/joblog/logDetailPage endpoint.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
  • M
Information Exposure

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Information Exposure on the /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat functions. A low privileged user can expose or delete log data that they are not authorized to access.

How to fix Information Exposure?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
  • H
Insecure Permissions

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Insecure Permissions which allows low privileged users to execute admin functions.

How to fix Insecure Permissions?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
  • M
HTML Injection

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to HTML Injection. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update.

How to fix HTML Injection?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
  • M
Information Exposure

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Information Exposure via the pageList parameter.

How to fix Information Exposure?

There is no fixed version for com.xuxueli:xxl-job.

[2.2.0,)
  • M
Server-side Request Forgery (SSRF)

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the /admin/controller/JobLogController.java component.

How to fix Server-side Request Forgery (SSRF)?

Upgrade com.xuxueli:xxl-job to version 2.4.0 or higher.

[,2.4.0)
  • M
Cross-site Scripting (XSS)

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the task management, due to improper input sanitization.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
  • M
Cross-site Request Forgery (CSRF)

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) that allows attackers to arbitrarily create administrator accounts, modify passwords, perform task scheduling and other operations via the /gaia-job-admin/user/add component.

How to fix Cross-site Request Forgery (CSRF)?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
  • M
Cross-site Scripting (XSS)

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via bypassing the 20-character limit in xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.

How to fix Cross-site Scripting (XSS)?

Upgrade com.xuxueli:xxl-job to version 2.3.0 or higher.

[,2.3.0)
  • H
Cross-site Scripting (XSS)

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the AppName or AddressList parameters in JobGroupController.java file.

How to fix Cross-site Scripting (XSS)?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
  • H
Information Disclosure

com.xuxueli:xxl-job is a distributed task scheduling framework.

Affected versions of this package are vulnerable to Information Disclosure of username, model, and password via job/admin/controller/UserController.java.

How to fix Information Disclosure?

There is no fixed version for com.xuxueli:xxl-job.

[0,)
Go back to all versions of this package