PT-2020-19268
CVE-2020-6856
·
تاريخ النشر
2020-02-06
·
تاريخ التحديث
2020-02-07
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
SOS JobScheduler versions 1.12 through 1.13.2
Description
A vulnerability exists in the JOC Cockpit component, allowing attackers to read files from the server via an entity declaration in XML documents used for job and order run-time settings.
Recommendations
For SOS JobScheduler versions 1.12 through 1.13.2, consider disabling the XML External Entity (XEE) processing in the JOC Cockpit component until a patch is available. Restrict access to sensitive files on the server to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾