PatchTheCVECVE-2023-37272: JS7 is an Open Source Job Scheduler
CVE-2023-37272 is a medium-severity flaw (CVSS 6.3) affecting jobscheduler. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 67%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2023-07-13 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-37272?
jobscheduler: upgrade to 1.13.19. Exact commands for each OS are on this page.
Is CVE-2023-37272 being exploited?
CVE-2023-37272 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-37272 affect?
CVE-2023-37272 affects jobscheduler. Severity is medium (CVSS 6.3). JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. R
How urgent is CVE-2023-37272?
Priority 30/100. No elevated risk signals yet.
Related CVEs
- CVE-2020-6856 MEDIUM 6.5 DOWNGRADE An XML External Entity (XEE) vulnerability exists in the JOC Cockpit component of SOS JobScheduler 1.12 and 1.
- CVE-2020-6855 MEDIUM 6.5 DOWNGRADE A large or infinite loop vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 allows
- CVE-2020-6854 MEDIUM 5.4 DOWNGRADE A cross-site scripting (XSS) vulnerability in the JOC Cockpit component of SOS JobScheduler 1.11 and 1.13.2 al
- CVE-2020-12712 HIGH 7.5 UPGRADE A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobSchedul
- CVE-2014-5393 MEDIUM 4.0 UPGRADE Directory traversal vulnerability in the JobScheduler Operations Center (JOC) in SOS JobScheduler before 1.6.4