CVE-2024-3366

LOW

Xuxueli xxl-job <2.4.1 - Code Injection

Title source: llm

Description

A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.

References (4)

[Exploit, Issue Tracking] https://github.com/xuxueli/xxl-job/issues/3391

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.259480

[Third Party Advisory, VDB Entry] https://vuldb.com/?id.259480

[Third Party Advisory, VDB Entry] https://vuldb.com/?submit.308180

Scores

CVSS v3 3.5

EPSS 0.0011

EPSS Percentile 28.8%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Classification

CWE

CWE-502 CWE-74

Status published

Affected Products (2)

xuxueli/xxl-job < 2.4.1

com.xuxueli/xxl-job-core Maven

Timeline

Published Apr 06, 2024

Tracked Since Feb 18, 2026