CVE-2025-9263

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-9263
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/xuxueli/xxl-job/issues/3772 Exploit Issue Tracking Vendor Advisory
https://github.com/xuxueli/xxl-job/issues/3772#issue-3308329205 Exploit Issue Tracking Vendor Advisory
https://vuldb.com/?ctiid.320805 Permissions Required VDB Entry
https://vuldb.com/?id.320805 Third Party Advisory VDB Entry
https://vuldb.com/?submit.631704 Third Party Advisory VDB Entry
https://github.com/xuxueli/xxl-job/issues/3772 Exploit Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*
History

11 Sep 2025, 18:29

Type Values Removed Values Added
CWE CWE-639
CPE cpe:2.3:a:xuxueli:xxl-job:*:*:*:*:*:*:*:*
First Time Xuxueli xxl-job
Xuxueli
References () https://github.com/xuxueli/xxl-job/issues/3772 - () https://github.com/xuxueli/xxl-job/issues/3772 - Exploit, Issue Tracking, Vendor Advisory
References () https://github.com/xuxueli/xxl-job/issues/3772#issue-3308329205 - () https://github.com/xuxueli/xxl-job/issues/3772#issue-3308329205 - Exploit, Issue Tracking, Vendor Advisory
References () https://vuldb.com/?ctiid.320805 - () https://vuldb.com/?ctiid.320805 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.320805 - () https://vuldb.com/?id.320805 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.631704 - () https://vuldb.com/?submit.631704 - Third Party Advisory, VDB Entry

21 Aug 2025, 15:15

Type Values Removed Values Added
References () https://github.com/xuxueli/xxl-job/issues/3772 - () https://github.com/xuxueli/xxl-job/issues/3772 -
Summary
  • (es) Se ha detectado una vulnerabilidad en Xuxueli xxl-job hasta la versión 3.1.1. Esta vulnerabilidad afecta a la función getJobsByGroup del archivo /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Esta manipulación del argumento jobGroup conlleva un control indebido de los identificadores de recursos. El ataque puede ejecutarse en remoto. Se ha hecho público el exploit y puede que sea utilizado.

20 Aug 2025, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-20 23:15

Updated : 2025-09-11 18:29

NVD link : CVE-2025-9263

Mitre link : CVE-2025-9263

CVE.ORG link : CVE-2025-9263

JSON object : View

Products Affected

xuxueli

  • xxl-job
CWE
CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

CWE-639

Authorization Bypass Through User-Controlled Key