Privilege escalation in XXL-Job

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-33779 · ADVISORY
• silence-silence/xxl-job-lateral-privilege-escalation-vulnerability- · WEB
• xuxueli/xxl-job · PACKAGE
• xxl-job.com · WEB

com.xuxueli:xxl-job 的其他漏洞

• CVE-2024-24113高危 8.8xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.
• CVE-2020-24922高危 8.8Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execu…
• CVE-2023-26120中危 6.1This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add an…
• CVE-2023-27087高危 7.5Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageL…
• CVE-2023-0674中危 6.5A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality …