5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-9264

CVE-2025-9264: xxl-job Jobs Handler remove function allows improper control of resource identifiers via ID parameter

A vulnerability was found in Xuxueli xxl-job up to 3.1.1. Affected by this issue is the function remove of the file /src/main/java/com/xxl/job/admin/controller/JobInfoController.java of the component Jobs Handler. Performing manipulation of the argument ID results in improper control of resource identifiers. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-9264

CVE-2025-9264:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.xuxueli:xxl-job-admin	maven	<= 3.1.1	3.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in the xxl-job-admin component. The analysis of the provided information, particularly the GitHub issue and the commits between the vulnerable version (3.1.1) and the patched version (3.2.0), revealed that several functions in JobInfoController.java were affected. The primary function mentioned in the CVE is remove, but the same vulnerability pattern and fix were applied to start and pause (which calls stop) as well.

The root cause is the lack of authorization checks in the controller methods. These methods would accept a job ID and perform an action (remove, start, stop) without verifying if the user had the rights to do so. An attacker only needed to be authenticated to the application and could then iterate through job IDs to manipulate any job in the system.

The patch, found in commit b683e65168d17f87ba4cbabdee444e19c4824e65, rectifies this by obtaining the user's login information from the HttpServletRequest and passing it down to the service layer (XxlJobServiceImpl). The service layer methods were updated to include a call to JobInfoController.hasJobGroupPermission to validate that the user belongs to the job group of the target job before executing the action. This ensures that users can only manage jobs for which they have explicit permissions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.