What is CVE-2020-6856?

CVE-2020-6856 is a medium-severity vulnerability in Sos-Berlin Jobscheduler, classified under Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion). CVSS score: 6.5/10. Published 2020-02-06.

How severe is CVE-2020-6856?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2020-6856 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

XXE in Sos-Berlin Jobscheduler

CVE-2020-6856

An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders.

EPSS: 0.009 (56.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Sos-berlin Jobscheduler — versions 1.11, 1.13.2
N/a — versions n/a

Weakness classification (CWE)

CWE-776 — Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion)

Public proof-of-concept exploits

References

cve@mitre.org (x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2020-6856?: CVE-2020-6856 is a medium-severity vulnerability in Sos-Berlin Jobscheduler, classified under Improper Restriction of Recursive Entity References in DTDs (XML Entity Expansion). CVSS score: 6.5/10. Published 2020-02-06.
How severe is CVE-2020-6856?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2020-6856 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.