CVE-2025-7789

Katalog CVE

CVSS 3.7 · Low EPSS 0,31%

Kerentanan Inadequate Encryption Strength pada xuxueli xxl-job. Skor CVSS 3.1 3.7 (Low) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was found in Xuxueli xxl-job up to 3.1.1 and classified as problematic. Affected by this issue is the function makeToken of the file src/main/java/com/xxl/job/admin/controller/IndexController.java of the component Token Generation. The manipulation leads to password hash with insufficient computational effort. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Rincian

Terbit di NVD

18 Juli 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-326: Inadequate Encryption Strength
CWE-916: Use of Password Hash With Insufficient Computational Effort

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/xuxueli/xxl-job/issues/3751 exploit · issue tracking · advisory vendor
• https://vuldb.com/?id.316850 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.615760 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.316850 permissions required · vdb entry