Description
A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://packetstormsecurity.com/files/158112/SOS-JobScheduler-1.13.3-Stored-Password-Decryption.htmlThird Party Advisory
- https://change.sos-berlin.com/browse/JOE-290Vendor Advisory
- https://kb.sos-berlin.com/display/PKB/Vulnerability+Release+1.13.4Release Notes, Vendor Advisory
- https://www.sos-berlin.com/en/newsVendor Advisory
- http://packetstormsecurity.com/files/158112/SOS-JobScheduler-1.13.3-Stored-Password-Decryption.htmlThird Party Advisory
- https://change.sos-berlin.com/browse/JOE-290Vendor Advisory
- https://kb.sos-berlin.com/display/PKB/Vulnerability+Release+1.13.4Release Notes, Vendor Advisory
- https://www.sos-berlin.com/en/newsVendor Advisory
Timeline
- Published
- Jun 11, 2020
- Last modified
- Jun 17, 2026
- NVD status
- Modified