Xxe

2020-02-0617:15:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders.

CPENameOperatorVersion
jobschedulereq1.11
jobschedulereq1.13.2

CPE	Name	Operator	Version
	jobscheduler	eq	1.11
	jobscheduler	eq	1.13.2

References

change.sos-berlin.com/browse/JOC-853