Wiz
Vulnerability DatabaseCVE-2023-48089

CVE-2023-48089: 
Java vulnerability analysis and mitigation

Overview

xxl-job-admin version 2.4.0 contains a Remote Code Execution (RCE) vulnerability via the /xxl-job-admin/jobcode/save endpoint. The vulnerability was discovered in November 2023 and affects the job code saving functionality of the application (GitHub Issue, NVD).

Technical details

The vulnerability exists due to insufficient privilege validation in the /xxl-job-admin/jobcode/save endpoint. The application does not properly validate user privileges when modifying code in running cronjobs for job executors. This allows unprivileged users to modify and execute arbitrary code on the job executor. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Impact

Successful exploitation of this vulnerability allows attackers to execute arbitrary code on the job executor system. This can lead to sensitive information disclosure, system compromise, and potential remote shell access to the affected systems (GitHub Issue).

Mitigation and workarounds

Users should avoid using version 2.4.0 of the xxl-job-admin package to mitigate this vulnerability (FortiGuard).

Additional resources

Source: This report was generated using AI

Related Java vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2025-14306CRITICAL10
  • JavaJava
  • net.sf.robocode:robocode.core
NoYesDec 09, 2025
CVE-2025-14307CRITICAL9.3
  • JavaJava
  • net.sf.robocode:robocode.battle
NoYesDec 09, 2025
CVE-2025-66566HIGH8.2
  • JavaJava
  • at.yawk.lz4:lz4-java
NoYesDec 05, 2025
CVE-2025-66623HIGH7.4
  • JavaJava
  • io.strimzi:strimzi
NoYesDec 05, 2025
GHSA-93fv-4pm9-xp28MEDIUM6.9
  • JavaJava
  • net.dv8tion:jda
NoYesDec 09, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo