The vulnerability in xuxueli xxl‑job allows an attacker to cause the application to make unauthorized outbound HTTP requests, enabling the retrieval or manipulation of data on internal or external resources. This is a classic server‑side request forgery flaw (CWE‑918). The impact includes possible confidentiality and integrity violations on systems accessible by the server, and it may expose internal network resources to external exploitation.

Vendors: xuxueli; Product: xxl‑job; Versions affected: any release up to and including 3.3.2. No specific later versions are listed as affected; newer releases are presumed safe unless otherwise noted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The exploit requires remote access to the xxl‑job administrative interface and the ability to submit a specially crafted request to JobInfoController.java. The attacker can then force the server to make requests to arbitrary URLs controlled by the attacker, potentially exfiltrating sensitive data or interacting with internal services.