VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Apr 6, 2024· Updated Aug 21, 2024

Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection

CVE-2024-3366

Description

A vulnerability classified as problematic was found in Xuxueli xxl-job up to 2.4.1. This vulnerability affects the function deserialize of the file com/xxl/job/core/util/JdkSerializeTool.java of the component Template Handler. The manipulation leads to injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259480.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.xuxueli:xxl-job-coreMaven
<= 2.4.0—

Affected products

1

Patches

2
92577cc33e39
https://github.com/xuxueli/xxl-jobvia osv
e3b2e1234614

1、"CVE-2024-3366" freemarker模板注入漏洞修复。

https://github.com/xuxueli/xxl-jobxuxueliApr 13, 2024via ghsa
commit
6 files changed · +13 −10
  • doc/images/img_Qohm.png+0 −0 modified
  • doc/XXL-JOB官方文档.md+5 −3 modified
    @@ -2349,9 +2349,11 @@ public void execute() {
 ### 7.34 版本 v2.4.1 Release Notes[规划中]
 - 1、【优化】多个项目依赖升级至较新稳定版本，涉及netty、groovy、springboot、mybatis等；
 - 2、【修复】"CVE-2022-43402" groovy低版本漏洞修复。
-- 3、【修复】调度日志页面XSS漏洞修复(ISSUE-3360)。
-- 4、[规划中]注册节点，弹框分页展示；解决注册节点过多时无法展示问题；
-
+- 3、【修复】"CVE-2024-29025" netty低版本漏洞修复。
+- 4、【修复】"CVE-2024-3366" freemarker模板注入漏洞修复。
+- 5、【修复】调度日志页面XSS漏洞修复(ISSUE-3360)。
+- 6、[规划中]登陆态Token声称逻辑优化，混淆登陆时间属性，降低token泄漏风险。
+- 7、[规划中]注册节点，弹框分页展示；解决注册节点过多时无法展示问题；
 
 ### TODO LIST
 - 1、调度隔离：调度中心针对不同执行器，各自维护不同的调度和远程触发组件。
  • doc/XXL-JOB架构图.key+0 −0 added
  • doc/XXL-JOB架构图.pptx+0 −0 removed
  • pom.xml+7 −7 modified
    @@ -24,24 +24,24 @@
 		<maven.compiler.target>1.8</maven.compiler.target>
 		<maven.test.skip>true</maven.test.skip>
 
-		<netty.version>4.1.106.Final</netty.version>
+		<netty.version>4.1.108.Final</netty.version>
 		<gson.version>2.10.1</gson.version>
 
-		<spring.version>5.3.31</spring.version>
+		<spring.version>5.3.34</spring.version>
 		<spring-boot.version>2.7.18</spring-boot.version>
 
 		<mybatis-spring-boot-starter.version>2.3.2</mybatis-spring-boot-starter.version>
 		<mysql-connector-j.version>8.3.0</mysql-connector-j.version>
 
-		<slf4j-api.version>2.0.11</slf4j-api.version>
-		<junit-jupiter.version>5.10.1</junit-jupiter.version>
+		<slf4j-api.version>2.0.13</slf4j-api.version>
+		<junit-jupiter.version>5.10.2</junit-jupiter.version>
 		<javax.annotation-api.version>1.3.2</javax.annotation-api.version>
 
-		<groovy.version>4.0.18</groovy.version>
+		<groovy.version>4.0.21</groovy.version>
 
-		<maven-source-plugin.version>3.3.0</maven-source-plugin.version>
+		<maven-source-plugin.version>3.3.1</maven-source-plugin.version>
 		<maven-javadoc-plugin.version>3.6.3</maven-javadoc-plugin.version>
-		<maven-gpg-plugin.version>3.1.0</maven-gpg-plugin.version>
+		<maven-gpg-plugin.version>3.2.3</maven-gpg-plugin.version>
 	</properties>
 
 	<build>
  • xxl-job-admin/src/main/resources/application.properties+1 −0 modified
    @@ -17,6 +17,7 @@ spring.freemarker.suffix=.ftl
 spring.freemarker.charset=UTF-8
 spring.freemarker.request-context-attribute=request
 spring.freemarker.settings.number_format=0.##########
+spring.freemarker.settings.new_builtin_class_resolver=safer
 
 ### mybatis
 mybatis.mapper-locations=classpath:/mybatis-mapper/*Mapper.xml

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.