Vulnerabilities > CVE-2024-3366 - Deserialization of Untrusted Data vulnerability in Xuxueli Xxl-Job

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

xuxueli

CWE-502

critical

NVD

Published: 2024-04-06

Updated: 2025-05-07

Summary

A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.

Vulnerable Configurations

Part	Description	Count
Application	Xuxueli Xuxueli XXL JOB 1.0.0.0 Xuxueli XXL JOB 1.2.0 Xuxueli XXL JOB 1.3.0 Xuxueli XXL JOB 1.3.1 Xuxueli XXL JOB 1.3.2 Xuxueli XXL JOB 1.4.0 Xuxueli XXL JOB 1.4.2 Xuxueli XXL JOB 1.5.0 Xuxueli XXL JOB 1.5.1 Xuxueli XXL JOB 1.5.2 Xuxueli XXL JOB 1.6.0 Xuxueli XXL JOB 1.6.2 Xuxueli XXL JOB 1.7.0 Xuxueli XXL JOB 1.7.1 Xuxueli XXL JOB 1.7.2 Xuxueli XXL JOB 1.8.0 Xuxueli XXL JOB 1.8.1 Xuxueli XXL JOB 1.8.2 Xuxueli XXL JOB 1.9.0 Xuxueli XXL JOB 1.9.1 Xuxueli XXL JOB 1.9.2 Xuxueli XXL JOB 2.0.0 Xuxueli XXL JOB 2.0.1 Xuxueli XXL JOB 2.0.2 Xuxueli XXL JOB 2.1.0 Xuxueli XXL JOB 2.1.1 Xuxueli XXL JOB 2.1.2 Xuxueli XXL JOB 2.2.0 Xuxueli XXL JOB 2.3.0 Xuxueli XXL JOB 2.3.1 Xuxueli XXL JOB 2.4.0 Xuxueli XXL JOB 2.4.1	32

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References