-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability centers around insecure deserialization in JdkSerializeTool.java. The deserialize method directly uses ObjectInputStream.readObject() on untrusted input, which is a well-known anti-pattern for Java applications. This allows arbitrary object deserialization attacks. While other utility classes (ScriptUtil, FileUtil) are mentioned as exploitation vectors, the root cause is the insecure deserialization in JdkSerializeTool. The CWE-74 classification and public exploit POC confirm this is an injection vulnerability stemming from improper input neutralization during deserialization. The GitHub issue #3391 explicitly links template injection attacks to this deserialization weakness as the entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.xuxueli:xxl-job-core | maven | <= 2.4.0 |