A manipulation of the addressList argument within the triggerJob function of Xuxueli xx‑job’s trigger endpoint enables server‑side request forgery. By providing arbitrary URLs, an attacker could cause the server to issue unintended HTTP requests to internal or external resources. The official description states that this flaw can be triggered remotely and that an exploit is publicly available. However, the project maintainer notes that triggering a job requires authentication and appropriate management privileges, implying that an attacker would need valid credentials to exploit the vulnerability.

The vulnerability affects the Xuxueli xxl‑job component, specifically the triggerJob method in the xxl‑job‑admin module, in all releases up to and including version 3.3.2.

The CVSS score of 5.3 indicates a medium severity flaw. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Attack likely requires remote access to the triggerJob API combined with valid administrative authentication. If exploited, the server‑side request forgery could allow an attacker to reach internal services, exfiltrate data, or pivot to further network targets. The overall risk is moderate, primarily limited by the need for authorized access to the endpoint.