CVEvulnerability

CVE-2020-6856

6.5 MEDIUM Published 2020-02-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-02-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N
Weaknesses
CWE-776

Description

An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders.

Affected configurations

• sos-berlin jobscheduler 1.11 • sos-berlin jobscheduler 1.13.2

Related

Weakness · CWE (1)

  • CWE-776 Improper Restriction of Recursive Entity References in DTDs weakness

References