PT-2020-19267 · Sos · Sos Jobscheduler

Oliver Haufe · Published 2020-02-06 · Updated 2020-02-07 · CVE-2020-6855

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SOS JobScheduler versions 1.11 through 1.13.2

Description A large or infinite loop issue in the JOC Cockpit component allows attackers to parameterize housekeeping jobs, potentially exhausting system resources and resulting in a denial of service.

Recommendations For SOS JobScheduler versions 1.11 through 1.13.2, consider restricting access to the JOC Cockpit component to minimize the risk of exploitation until a patch is available.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2020-6855

Affected Products

Sos Jobscheduler

References · 3

• https://osv.dev/vulnerability/CVE-2020-6855 · Vendor Advisory
• https://change.sos-berlin.com/browse/JITL-590 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6855 · Security Note