TI-2023-18902 Aliases CVE-2023-37272

XSS vulnerability in JOC Cockpit branch 1.13

LOW 28CWE-79Published 2023-07-13 · Updated 2024-10-21

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00393 33rd percentileScored 2026-11-07

Fix Fixed joc-cockpit (sos-berlin): 1.13.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sos-berlin	joc-cockpit	before 1.13.19	1.13.19	Patch available	CNA

joc-cockpit Vendorsos-berlin Affected before 1.13.19 Fixed in 1.13.19 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sos-berlin:jobscheduler::::::::	before 1.13.19	Vulnerable	sos-berlin

cpe:2.3:a:sos-berlin:jobscheduler:*:*:*:*:*:*:*:* Versions before 1.13.19 Vulnerable ·sos-berlin

Remediation

Fix · CNA joc-cockpit (sos-berlin) Fixed in 1.13.19

Timeline

2026-10-02 Threatist record created from CVE-2023-37272

References

Patch 1

https://change.sos-berlin.com/browse/SET-226

Advisory 1

https://github.com/sos-berlin/joc-cockpit/security/advisories/GHSA-qr44-gm3x-7hfc

TI-2020-10107 A vulnerability based on insecure user/password encryption in the JOE (job editor)… CVSS 3.1HIGH 7.5
TI-2020-05561 An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS… CVSS 3.1MEDIUM 6.5
TI-2020-05560 A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler… CVSS 3.1MEDIUM 6.5
TI-2020-05559 A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS… CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences