Vulnerability · Published Jul 13, 2023 · Assigned by GitHub_M

CVE-2023-37272XSS vulnerability in JOC Cockpit branch 1.13

Medium 6.3

In plain English

A medium-severity cross-site scripting in joc-cockpit from sos-berlin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 66.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19.

Affected products (as reported)

Vendor	Product	Versions
sos-berlin	joc-cockpit	< 1.13.19

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc x_refsource_CONFIRM
https://change.sos-berlin.com/browse/SET-226 x_refsource_MISC