This vulnerability exists in the xxl-job v3.4.0 administration interface at the jobinfo/trigger endpoint. Authenticated users can exploit the SSRF flaw to make the server perform HTTP requests to arbitrary resources, potentially enabling resource scanning. The vulnerability is confirmed published but lacks detailed CVSS scoring and remediation information. No known exploits in the wild have been reported.

An authenticated attacker can leverage this SSRF vulnerability to scan internal or external network resources via the vulnerable endpoint. This may lead to information disclosure about internal network structure or services accessible from the server. The exact impact depends on the attacker's access and the network environment. No direct evidence of further exploitation or privilege escalation is provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint to trusted users only and monitor for suspicious activity involving the jobinfo/trigger interface.