CVE-2026-3733mediumCWE-918

CVE-2026-3733: fallo de gravedad media en xuxueli xxl-job

xuxueli xxl-job JobInfoController.java server-side request forgery

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear xxl-job

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.2%
A vulnerability was detected in xuxueli xxl-job up to 3.3.2. This impacts an unknown function of the file source-code/src/main/java/com/xxl/job/admin/controller/JobInfoController.java. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit is now public and may be used. The project maintainer closed the issue report with the following statement: "Access token security verification is required." (translated from Chinese)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
xuxueli · xxl-job
CVEs relacionadas — xuxueli xxl-job

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-65316HIGHxxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCatEPSS 0.5%CVE-2026-94426MEDIUMxuxueli xxl-job insert cross site scriptingEPSS 0.3%CVE-2026-94145MEDIUMxuxueli xxl-job Task Management JobInfoController.java cross site scriptingEPSS 0.3%