CVE-2022-36157: 
Java vulnerability analysis and mitigation

XXL-JOB, all versions as of July 11, 2022, contains an Escalation of Privileges vulnerability that allows low-privileged users to execute administrative functions. The vulnerability was discovered in the open-source distributed task scheduling framework that is used by multiple companies in their product lines (GitHub Issue).

The vulnerability exists in the access control mechanism of the application. A low-privileged user can bypass intended access restrictions by directly accessing the '/jobgroup' endpoint, which provides unauthorized access to the 'Executor management' function that should only be available to administrators (GitHub Issue).

This vulnerability allows authenticated users with low privileges to access and modify administrative functions, specifically the Executor management feature, effectively bypassing the intended access control restrictions (GitHub Issue).

The vulnerability is easily exploitable by authenticated users. An attacker only needs valid low-privilege credentials and can exploit the vulnerability by directly manipulating the URL to access restricted administrative functions (GitHub Issue).