CVE-2025-7789

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-7789
A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with insufficient computational effort. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

3.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/xuxueli/xxl-job/issues/3751 Exploit Issue Tracking Vendor Advisory
https://vuldb.com/?ctiid.316850 Permissions Required VDB Entry
https://vuldb.com/?id.316850 Third Party Advisory VDB Entry
https://vuldb.com/?submit.615760 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*
History

11 Sep 2025, 19:35

Type Values Removed Values Added
CPE cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*
References () https://github.com/xuxueli/xxl-job/issues/3751 - () https://github.com/xuxueli/xxl-job/issues/3751 - Exploit, Issue Tracking, Vendor Advisory
References () https://vuldb.com/?ctiid.316850 - () https://vuldb.com/?ctiid.316850 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.316850 - () https://vuldb.com/?id.316850 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.615760 - () https://vuldb.com/?submit.615760 - Third Party Advisory, VDB Entry
First Time Xuxueli xxl-job
Xuxueli

22 Jul 2025, 13:06

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad en Xuxueli xxl-job hasta la versión 3.1.1, clasificada como problemática. Este problema afecta a la función makeToken del archivo src/main/java/com/xxl/job/admin/controller/IndexController.java del componente Token Generation. La manipulación genera un hash de contraseña con un esfuerzo computacional insuficiente. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta. Parece difícil de explotar. Se ha hecho público el exploit y puede que sea utilizado.

18 Jul 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-18 16:15

Updated : 2025-09-11 19:35

NVD link : CVE-2025-7789

Mitre link : CVE-2025-7789

CVE.ORG link : CVE-2025-7789

JSON object : View

Products Affected

xuxueli

  • xxl-job
CWE
CWE-326

Inadequate Encryption Strength

CWE-916

Use of Password Hash With Insufficient Computational Effort