Cronicle event params allow environment variable injection and privilege escalation
Ordinary users of this task scheduler can seize administrator rights!
Summary
In the Cronicle task scheduler, a logged-in non-admin user can add undeclared keys to event params and change the process environment. This can lead to privilege escalation, code execution, data access or service disruption. Versions before 0.9.124 are affected.
Affected when
- Logged-in user with run_events, create_events or edit_events privilege
- Versions before 0.9.124
What to do
Update to 0.9.124 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen