This vulnerability involves an SSRF flaw in the xxl-job-admin/jobinfo/trigger component of xxl-job version 3.4.0. Authenticated attackers can exploit this issue to make the server send crafted HTTP requests, potentially scanning internal or external resources that the server can access. The CVSS vector indicates the attack requires network access with low complexity and privileges, no user interaction, and impacts confidentiality but not integrity or availability.

An attacker with authentication privileges can leverage this SSRF vulnerability to scan internal network resources or external systems accessible by the server. This could lead to information disclosure about internal infrastructure or other systems reachable from the vulnerable server. There is no indication of direct impact on system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the vulnerable component to trusted users and monitor for suspicious activity related to HTTP request triggering. Avoid exposing the vulnerable interface to untrusted networks.