| शीर्षक | xuxueli https://github.com/xuxueli/xxl-job v3.3.2 Authorization Bypass |
|---|
| विवरण | An Insecure Direct Object Reference (IDOR) vulnerability exists in xxl-job-admin/joblog/logDetailCat. Any authenticated user who can obtain or guess a valid logId can read execution log content belonging to job groups they are not authorized to access.
Unlike the adjacent log detail page, the JSON log-reading endpoint does not enforce job-group authorization before returning log content. This leads to unauthorized disclosure of job execution logs, which may contain sensitive business parameters, internal network addresses, stack traces, operational metadata, and secrets written by jobs during execution. |
|---|
| स्रोत | ⚠️ https://github.com/xuxueli/xxl-job/issues/3936 |
|---|
| उपयोगकर्ता | larlarua (UID 97278) |
|---|
| सबमिशन | 12/04/2026 11:29 AM (2 महीनों पहले) |
|---|
| संयम | 28/04/2026 01:45 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359959 [Xuxueli xxl-job तक 3.3.2 Execution Log JobLogController.java logDetailCat logId अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|