What is GHSA-cpfp-m5qw-c4r3?

GHSA-cpfp-m5qw-c4r3 is a security advisory published by GitHub Security Advisories with High severity. Improper Preservation of Permissions in xxl-job

Which CVE IDs does GHSA-cpfp-m5qw-c4r3 cover?

GHSA-cpfp-m5qw-c4r3 covers the following CVE IDs: CVE-2024-42681. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cpfp-m5qw-c4r3?

GHSA-cpfp-m5qw-c4r3 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-cpfp-m5qw-c4r3?

GHSA-cpfp-m5qw-c4r3 affects 1 product, including: maven/com.xuxueli:xxl-job-core:\u003c= 2.4.1.

GHSA-cpfp-m5qw-c4r3HighCVSS 8.8

Improper Preservation of Permissions in xxl-job

Vendor

GitHub Security Advisories

Published

August 15, 2024

Last Modified

May 22, 2025

🔗 CVE IDs covered (1)

CVE-2024-42681 →

📋 Description

Insecure Permissions vulnerability in xxl-job v.2.4.1 allows a remote attacker to execute arbitrary code via the Sub-Task ID component.

🎯 Affected products1

maven/com.xuxueli:xxl-job-core:<= 2.4.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-42681
https://github.com/xuxueli/xxl-job/issues/3516
https://github.com/xuxueli/xxl-job/commit/a2dc9011310628f3e18c3a5095e7e6a946d017bd
https://github.com/advisories/GHSA-cpfp-m5qw-c4r3