EUVD-2026-44843
GHSA-vvf7-cx4c-9x2c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CSRF requires a logged-in admin to visit a malicious page (UI:R) and is blind (C:N); it forges state-changing script edits giving high integrity impact (I:H).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive request mapping
AnalysisAI
Cross-Site Request Forgery in the xxl-job-admin console of XXL-JOB v3.0.0 lets remote attackers silently modify Glue IDE shell scripts by tricking an authenticated administrator into triggering a forged request. Because Glue scripts are executed by the scheduler's worker nodes, unauthorized script modification can escalate into arbitrary command execution across the job-execution fabric. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim who is a currently-authenticated xxl-job-admin user (typically an administrator with Glue script permissions) to be lured into loading attacker-controlled web content while their session is active - user interaction is mandatory despite the NVD vector's UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and warrant scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious web page containing an auto-submitting form or fetch request targeting the xxl-job-admin Glue script-update endpoint, then lures a currently-authenticated XXL-JOB administrator to visit it (e.g., via phishing). The victim's browser submits the forged request with their valid session cookie, silently overwriting a Glue shell script with attacker-controlled content that later executes on executor nodes. … |
| Remediation | No vendor-released patch version is identified in the available data, so the primary compensating controls should be applied while monitoring the XXL-JOB project for a fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all XXL-JOB v3.0.0 instances and restrict admin console network access to trusted administrative networks using firewall rules; publicly available exploit code exists, raising operational urgency. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when
Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today