CVE-2020-6856 XML external entity in n/a
Attackers can read server files via XML External Entity injection in SOS JobScheduler JOC Cockpit run-time settings.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6856?
CVE-2020-6856 is a medium-severity vulnerability in n/a, published on 6 Feb 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders.
Weakness: CWE-776
Which versions are affected by CVE-2020-6856?
It affects 1 product.
Products include Sos-Berlin Jobscheduler.
How do I fix CVE-2020-6856?
No fix has been published for CVE-2020-6856 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-6856 being exploited?
There is no known exploitation of CVE-2020-6856 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-p9v4-8pgw-x8xr.