CVE-2023-33779
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the /jobinfo/ component.
Risk Assessment
An attacker can take over another user's account, leading to unauthorized data access and the ability to perform tasks on their behalf.
Recommendation
Immediately update XXL-Job to the latest version that fixes this vulnerability and restrict access to the /jobinfo/ component to trusted users only.
Other vulnerabilities in XXL-Job
See all- CVE-2026-52371Medium
xxl-job version 3.4.0 contains an SSRF vulnerability in the xxl-job-admin/jobinfo/trigger component. Authenticated attackers can scan resources via a crafted HTTP request.
- CVE-2026-65316Medium
XXL-Job version 2.4.2 has an insecure direct object reference vulnerability. Authenticated users can read execution logs from unauthorized job groups by supplying sequential log IDs to the logDetailCat endpoint.
Original NVD description (English source)
A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/.