CVE-2024-3366
Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.
Una vulnerabilidad fue encontrada en Xuxueli xxl-job hasta 2.4.1 y clasificada como problemática. Esta vulnerabilidad afecta la función deserialize del archivo com/xxl/job/core/util/JdkSerializeTool.java del componente Template Handler. La manipulación conduce a la inyección. El exploit ha sido divulgado al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-259480.
In Xuxueli xxl-job bis 2.4.1 wurde eine Schwachstelle entdeckt. Sie wurde als problematisch eingestuft. Es geht um die Funktion deserialize der Datei com/xxl/job/core/util/JdkSerializeTool.java der Komponente Template Handler. Dank Manipulation mit unbekannten Daten kann eine injection-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-04-05 CVE Reserved
- 2024-04-06 CVE Published
- 2024-04-07 EPSS Updated
- 2024-08-21 CVE Updated
- 2024-08-21 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://vuldb.com/?id.259480 | Technical Description | |
| https://vuldb.com/?submit.308180 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://github.com/xuxueli/xxl-job/issues/3391 | 2024-08-21 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Xuxueli Search vendor "Xuxueli" | Xxl-job Search vendor "Xuxueli" for product "Xxl-job" | 2.4.0 Search vendor "Xuxueli" for product "Xxl-job" and version "2.4.0" | en |
Affected
| ||||||
| Xuxueli Search vendor "Xuxueli" | Xxl-job Search vendor "Xuxueli" for product "Xxl-job" | 2.4.1 Search vendor "Xuxueli" for product "Xxl-job" and version "2.4.1" | en |
Affected
| ||||||