Denial of Service (DOS) Vulnerability allows to exhaust resources when calculating the daily plan (CVE-2020-6855)

Vulnerability

• A DOS vulnerability has been identified, see see https://en.wikipedia.org/wiki/Denial-of-service_attack
• An attacker with the privilege to modify or to start a job or order can parameterize jobs to calculate the daily plan for a large number of future days. A similar operation is available from the REST API. This will result in the JOC Cockpit becoming unavailable. By default the daily plan is calculated 31 days ahead.
• Severity Level: MEDIUM
  • In order to take advantage of the vulnerability, you must have a valid account in the application that allows you to perform a specific action. The attacker must therefore be the holder of account credentials with privileges to modify or to start jobs or orders.

Mitigation

• The classes calculating the daily plan limit any parameterization exceeding 2000 days.