| शीर्षक | xuxueli XXL-JOB 3.4.2 Improper Privilege Management |
|---|
| विवरण | A vulnerability was found in Xuxueli xxl-job version 3.4.2. It has been classified as problematic. The affected component is the JobGroupController in xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The @XxlSso(role = Consts.ADMIN_ROLE) annotation is commented out on the /jobgroup/loadById endpoint, allowing any authenticated user to access the endpoint and retrieve executor group information (addressList, appname, registryList, etc.). This leads to improper privilege management. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to a patched version is recommended. |
|---|
| स्रोत | ⚠️ https://github.com/zhaizejiang/xxl-job-vuln-poc/edit/main/xxl-job3.4.2_loadById%20Endpoint%20Missing%20Authentication.md |
|---|
| उपयोगकर्ता | zhaizejiang (UID 99755) |
|---|
| सबमिशन | 14/07/2026 05:18 AM (2 महीनों पहले) |
|---|
| संयम | 12/09/2026 10:04 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 403075 [Xuxueli xxl-job तक 3.4.2 JobGroupController.java अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|