CVE-2025-7787: SSRF Vulnerability in com.xuxueli:xxl-job-core up to 3.1.1
Summary
CVE-2025-7787: XXL-JOB is vulnerable to SSRF attacks. Affects com.xuxueli:xxl-job-core versions < 3.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
XXL-JOB is a distributed task scheduling framework designed for Java applications. It allows users to manage and execute scheduled tasks efficiently. The framework is widely used for its simplicity and effectiveness in handling job scheduling, making it a popular choice among developers. However, versions up to 3.1.1 are vulnerable to a critical server-side request forgery (SSRF) attack, which can compromise the security of applications utilizing this package.
Vulnerability Detail
A critical vulnerability has been identified in the function httpJobHandler of the SampleXxlJob.java file within the XXL-JOB framework. This vulnerability allows an attacker to perform server-side request forgery (SSRF), enabling them to send unauthorized requests from the server to internal resources. The implications of this vulnerability are significant, as it can lead to unauthorized access to sensitive data and services within the network. The vulnerability affects all versions of the package up to 3.1.1, and it has been publicly disclosed, making it imperative for users to address it promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you are unable to update to the patched version immediately, consider implementing network-level restrictions to limit access to internal resources from the server. Additionally, validate and sanitize all incoming requests to prevent unauthorized access.
Conclusion
The SSRF vulnerability identified as CVE-2025-7787 in the com.xuxueli:xxl-job-core package poses a significant risk to applications using versions up to 3.1.1. It is crucial for users to update to version 3.1.2 or later to mitigate this risk and protect their applications from potential exploitation.
See every vulnerability recorded for com.xuxueli:xxl-job-core →
FAQ
Server-side request forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing the pom.xml file. Visit Vulert Scanner to check if your application is affected without any signup.
Failing to address this vulnerability may lead to unauthorized access to sensitive data, internal services, and potential exploitation by attackers, compromising the security of your application.
Yes, there is a risk of data loss or exposure, as attackers may exploit this vulnerability to access and manipulate sensitive information stored within your network.
The CVSS score of this vulnerability is 6.3, indicating a medium severity level that requires prompt attention.
Related vulnerabilities
Recent vulnerabilities recorded for com.xuxueli:xxl-job-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
