Technical impact
The vulnerability is a Cross‑Site Request Forgery (CSRF) flaw in the xxl‑job‑admin web application version 3.0.0. The endpoint responsible for modifying Glue IDE shell scripts lacks CSRF token validation and accepts arbitrary HTTP methods, allowing an attacker to forge a request that writes or overwrites those scripts. The result is the ability to alter the behavior of jobs scheduled by the platform, potentially changing job parameters or execution logic.
Affected Systems
Deployments of xxl‑job‑admin 3.0.0 are affected. The project is an open‑source distributed task scheduling platform. Any instance that exposes the vulnerable endpoint and is reachable by attackers is vulnerable. No commercial vendor is listed as the CNA for this product.
Risk and Exploitability
The CVSS score of 9.1 signals high severity, while the EPSS score of less than 1% indicates that exploitation has not been common to date. The vulnerability is not listed in CISA's KEV catalog. Exploitation would require an attacker to send a forged HTTP request to the vulnerable endpoint. While the description does not explicitly state authentication requirements, CSRF attacks typically need a victim with an active session; this inference is based on standard CSRF behavior. The permissive HTTP method mapping and missing CSRF protection make the attack relatively straightforward from a web client perspective.
