CVE-2025-9263: Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection
A vulnerability has been found in Xuxueli xxl-job up to 3.1.1. Affected by this vulnerability is the function getJobsByGroup of the file /src/main/java/com/xxl/job/admin/controller/JobLogController.java. Such manipulation of the argument jobGroup leads to improper control of resource identifiers. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9263?
CVE-2025-9263 has been classified with a medium severity due to improper control of resource access.
How does CVE-2025-9263 affect the xxl-job software?
CVE-2025-9263 affects the xxl-job software by allowing manipulation of the jobGroup parameter, potentially leading to unauthorized actions.
How can I fix CVE-2025-9263?
To fix CVE-2025-9263, upgrade to a version of xxl-job that is later than 3.1.1 to mitigate the vulnerability.
Which versions of xxl-job are affected by CVE-2025-9263?
Versions of xxl-job up to and including 3.1.1 are affected by CVE-2025-9263.
What component of xxl-job is vulnerable in CVE-2025-9263?
The vulnerable component in CVE-2025-9263 is the getJobsByGroup function in the JobLogController.java file.