PT-2025-30048 · Xxl-Job · Xxl-Job

Zast.Ai · Publicado 2025-07-18 · Atualizado 2025-07-18 · CVE-2025-7789

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions xxl-job versions up to 3.1.1

Description A flaw exists within the makeToken function located in src/main/java/com/xxl/job/admin/controller/IndexController.java of the Token Generation component. This issue involves password hashing with insufficient computational effort, potentially allowing for unauthorized access. The attack can be initiated remotely, but is considered difficult to exploit. The exploit details have been publicly disclosed.

Recommendations Update to a version beyond 3.1.1.

Exploit

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

CWE-916

Identificadores relacionados

CVE-2025-7789

GHSA-565H-44M8-4C2V

Produtos afetados

Xxl-Job

Referências · 10

• 🔥 https://github.com/xuxueli/xxl-job/issues/3751 · Exploit
• https://github.com/xuxueli/xxl-job/commit/cb1bd548a6d9512aab6f1ba9c5686de62f863fcd · Nota
• https://github.com/xuxueli/xxl-job · Nota
• https://vuldb.com/?id.316850 · Nota
• https://twitter.com/CVEnew/status/1946233233638895739 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-7789 · Nota de Segurança
• https://vuldb.com/?ctiid.316850 · Nota
• https://osv.dev/vulnerability/CVE-2025-7789 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-565h-44m8-4c2v · Aviso do Fabricante
• https://vuldb.com/?submit.615760 · Nota