high8.8
CVE-2022-43183
XXL-JOB vulnerable to Server-Side Request Forgery (SSRF)
Impact
XXL-Job before v2.4.0 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.xuxueli:xxl-job-core | < 2.4.0 | 2.4.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xuxueli | Xxl-Job | through 2.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/xuxueli/xxl-job/issues/3002
- https://github.com/advisories/GHSA-83w4-x5w9-hf4h
- https://nvd.nist.gov/vuln/detail/CVE-2022-43183
- https://github.com/xuxueli/xxl-job/releases/tag/2.3.1
- https://github.com/xuxueli/xxl-job/commit/9293c61ca0a8d54afdfb27cc568885ae639a14dc