CVE-2023-37272
Medium
Description
JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19.
SeverityMedium
CVSS6.3
Exploit probability—
ProductSos-berlin Jobscheduler
PublishedJul 13, 2023
First seenJul 13, 2023
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- sos-berlin jobscheduler1.13.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sos-berlin jobscheduler | v < 1.13.19 | 1.13.19 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.