CVE-2020-12712

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-06-11 · updated 2026-06-17
Weakness: CWE-330

Description

A vulnerability based on insecure user/password encryption in the JOE (job editor) component of SOS JobScheduler 1.12 and 1.13 allows attackers to decrypt the user/password that is optionally stored with a user's profile.

Affected products

sos-berlin Jobscheduler: from 1.12.0 through 1.12.12; from 1.13.0 through 1.13.3

References

http://packetstormsecurity.com/files/158112/SOS-JobScheduler-1.13.3-Stored-Password-Decryption.html
https://change.sos-berlin.com/browse/JOE-290
https://kb.sos-berlin.com/display/PKB/Vulnerability+Release+1.13.4
https://www.sos-berlin.com/en/news
http://packetstormsecurity.com/files/158112/SOS-JobScheduler-1.13.3-Stored-Password-Decryption.html
https://change.sos-berlin.com/browse/JOE-290
https://kb.sos-berlin.com/display/PKB/Vulnerability+Release+1.13.4
https://www.sos-berlin.com/en/news

Get alerted when CVE-2020-12712 or the next vulnerability affects your stack