GHSA-6rq7-m52p-8pqg

Source

https://github.com/advisories/GHSA-6rq7-m52p-8pqg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-6rq7-m52p-8pqg/GHSA-6rq7-m52p-8pqg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6rq7-m52p-8pqg

Aliases

CVE-2025-9263

Published

2025-08-21T00:30:20Z

Modified

2026-05-07T05:41:25Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

xxl-job Vulnerable to Resource Injection and Authorization Bypass Through User-Controlled Key

Details

A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Database specific

{
    "cwe_ids":  [
        "CWE-639",
        "CWE-99"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-07T05:16:09Z",
    "nvd_published_at":  "2025-08-20T23:15:30Z",
    "severity":  "LOW"
}

References

Affected packages

Maven / com.xuxueli:xxl-job-admin

Package

Name: com.xuxueli:xxl-job-admin; View open source insights on deps.dev
Purl: pkg:maven/com.xuxueli/xxl-job-admin

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.2.0

Database specific

last_known_affected_version_range

"<= 3.1.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-6rq7-m52p-8pqg/GHSA-6rq7-m52p-8pqg.json"