Search
Find a vulnerability
Search criteria
2 vulnerabilities found for joc-cockpit by sos-berlin
CVE-2023-37272 (GCVE-0-2023-37272)
Vulnerability from nvd – Published: 2023-07-13 22:28 – Updated: 2024-10-21 21:09
VLAI
EPSS
VEX
Title
XSS vulnerability in JOC Cockpit branch 1.13
Summary
JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/sos-berlin/joc-cockpit/securit… | x_refsource_CONFIRM |
| https://change.sos-berlin.com/browse/SET-226 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sos-berlin | joc-cockpit |
Affected:
< 1.13.19
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:09:34.055Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc"
},
{
"name": "https://change.sos-berlin.com/browse/SET-226",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://change.sos-berlin.com/browse/SET-226"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-37272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T21:06:41.506141Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-21T21:09:36.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joc-cockpit",
"vendor": "sos-berlin",
"versions": [
{
"status": "affected",
"version": "\u003c 1.13.19"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-13T22:28:34.238Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc"
},
{
"name": "https://change.sos-berlin.com/browse/SET-226",
"tags": [
"x_refsource_MISC"
],
"url": "https://change.sos-berlin.com/browse/SET-226"
}
],
"source": {
"advisory": "GHSA-qr44-gm3x-7hfc",
"discovery": "UNKNOWN"
},
"title": "XSS vulnerability in JOC Cockpit branch 1.13"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-37272",
"datePublished": "2023-07-13T22:28:34.238Z",
"dateReserved": "2023-06-29T19:35:26.440Z",
"dateUpdated": "2024-10-21T21:09:36.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-37272 (GCVE-0-2023-37272)
Vulnerability from cvelistv5 – Published: 2023-07-13 22:28 – Updated: 2024-10-21 21:09
VLAI
EPSS
VEX
Title
XSS vulnerability in JOC Cockpit branch 1.13
Summary
JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/sos-berlin/joc-cockpit/securit… | x_refsource_CONFIRM |
| https://change.sos-berlin.com/browse/SET-226 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| sos-berlin | joc-cockpit |
Affected:
< 1.13.19
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T17:09:34.055Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc"
},
{
"name": "https://change.sos-berlin.com/browse/SET-226",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://change.sos-berlin.com/browse/SET-226"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-37272",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T21:06:41.506141Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-21T21:09:36.457Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "joc-cockpit",
"vendor": "sos-berlin",
"versions": [
{
"status": "affected",
"version": "\u003c 1.13.19"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-13T22:28:34.238Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc"
},
{
"name": "https://change.sos-berlin.com/browse/SET-226",
"tags": [
"x_refsource_MISC"
],
"url": "https://change.sos-berlin.com/browse/SET-226"
}
],
"source": {
"advisory": "GHSA-qr44-gm3x-7hfc",
"discovery": "UNKNOWN"
},
"title": "XSS vulnerability in JOC Cockpit branch 1.13"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2023-37272",
"datePublished": "2023-07-13T22:28:34.238Z",
"dateReserved": "2023-06-29T19:35:26.440Z",
"dateUpdated": "2024-10-21T21:09:36.457Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}