| 제목 | Xuxueli https://github.com/xuxueli/xxl-job <=3.1.1 Use of a Broken or Risky Cryptographic Algorithm vulnerability ( |
|---|
| 설명 | Multiple versions of XXL-Job, including the latest version, contain a critical security vulnerability. The XXL_JOB_LOGIN_IDENTITY in the cookie is obtained by hexadecimal conversion of administrator user information. After decoding, it contains the administrator's uid, username, password hash (md5), role_id, and permission information. If hackers obtain the administrator's cookie through any means, it is equivalent to gaining access to these sensitive administrator user details. |
|---|
| 원천 | ⚠️ https://github.com/xuxueli/xxl-job/issues/3751 |
|---|
| 사용자 | ZAST.AI (UID 87884) |
|---|
| 제출 | 2025. 07. 14. PM 12:02 (1 년도 ago) |
|---|
| 모더레이션 | 2025. 07. 18. AM 09:33 (4 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 316850 [Xuxueli xxl-job 까지 3.1.1 Token Generation IndexController.java makeToken 약한 암호화] |
|---|
| 포인트들 | 20 |
|---|