PT-2025-30048 · Xxl-Job · Xxl-Job

Zast.Ai · Published 2025-07-18 · Updated 2025-07-18 · CVE-2025-7789

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions xxl-job versions up to 3.1.1

Description A flaw exists within the makeToken function located in src/main/java/com/xxl/job/admin/controller/IndexController.java of the Token Generation component. This issue involves password hashing with insufficient computational effort, potentially allowing for unauthorized access. The attack can be initiated remotely, but is considered difficult to exploit. The exploit details have been publicly disclosed.

Recommendations Update to a version beyond 3.1.1.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-916

Related Identifiers

CVE-2025-7789

GHSA-565H-44M8-4C2V

Affected Products

Xxl-Job

References · 10

• 🔥 https://github.com/xuxueli/xxl-job/issues/3751 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-7789 · Security Note
• https://osv.dev/vulnerability/CVE-2025-7789 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-565h-44m8-4c2v · Vendor Advisory
• https://github.com/xuxueli/xxl-job/commit/cb1bd548a6d9512aab6f1ba9c5686de62f863fcd · Note
• https://github.com/xuxueli/xxl-job · Note
• https://vuldb.com/?id.316850 · Note
• https://twitter.com/CVEnew/status/1946233233638895739 · Twitter Post
• https://vuldb.com/?ctiid.316850 · Note
• https://vuldb.com/?submit.615760 · Note