CVE-2023-37272 XSS vulnerability in JOC Cockpit branch 1.13

Medium 6.3 Published 13 Jul 2023 Updated 21 Oct 2024

Attackers can inject malicious scripts via crafted file names in JOC Cockpit, leading to code execution in the victim's browser.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-37272?

CVE-2023-37272 is a medium-severity cross-site scripting vulnerability in sos-berlin joc-cockpit, published on 13 Jul 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19.

Weakness: CWE-79

Which versions are affected by CVE-2023-37272?

It affects 1 product.

Products include Sos-Berlin Jobscheduler.

How do I fix CVE-2023-37272?

No fix has been published for CVE-2023-37272 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-37272 being exploited?

There is no known exploitation of CVE-2023-37272 in the wild and no public exploit code.

Sources

Also known as GHSA-qr44-gm3x-7hfc.