Skip to main content

Jobscheduler CVE-2020-6856

MEDIUM
Improper Restriction of Recursive Entity References in DTDs (CWE-776)
2020-02-06 cve@mitre.org
XXE Jobscheduler
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Feb 06, 2020 - 17:15 nvd
MEDIUM 6.5

DescriptionNVD

An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders.

AnalysisAI

An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-776. An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.13.2 allows attackers to read files from the server via an entity declaration in any of the XML documents that are used to specify the run-time settings of jobs and orders. Affected products include: Sos-Berlin Jobscheduler.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Jobscheduler

View all
CVE-2020-12712 HIGH POC
7.5 Jun 11

A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 an
CVE-2014-5393 MEDIUM POC
4.0 Sep 11

Directory traversal vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246 and 1.
CVE-2020-6855 MEDIUM
6.5 Feb 06

A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attackers
CVE-2014-5392 MEDIUM
5.8 Sep 23

XML External Entity (XXE) vulnerability in JobScheduler before 1.6.4246 and 7.x before 1.7.4241 allows remote attackers

CVE-2023-37272 MEDIUM
5.4 Jul 13

JS7 is an Open Source Job Scheduler. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low a
CVE-2020-6854 MEDIUM
5.4 Feb 05

A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows attac
CVE-2014-5391 MEDIUM
4.3 Sep 11

Cross-site scripting (XSS) vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4246

Same weakness CWE-776 – Improper Restriction of Recursive Entity References in DTDs

View all
CVE-2025-3225 HIGH POC
7.5
CVE-2026-26278 HIGH POC
7.5
CVE-2026-29074 HIGH POC
7.5
CVE-2023-49967 HIGH POC
7.5
CVE-2022-25857 HIGH POC
7.5
CVE-2022-0217 HIGH POC
7.5
CVE-2020-5227 HIGH POC
7.5
CVE-2019-12401 HIGH POC
7.5

Same technique XXE

View all
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2013-5014 HIGH POC
7.5
CVE-2015-0923 MEDIUM POC
5.0
CVE-2014-0644 HIGH POC
7.8

Share

CVE-2020-6856 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy