CVE-2013-3632

The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

56.84% chance of exploitation in the next 30 days, 99th percentile

Published

2014-09-29

Updated

2024-08-06

Proof-of-concept exploits (1)

• http://www.exploit-db.com/exploits/29323

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/openmediavault_auth_…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/29323

References

• CVE Record
• NVD entry

Related

• CVE-2013-3631
• CVE-2013-3635
• CVE-2013-3630
• CVE-2013-3636
• CVE-2013-3629
• CVE-2013-3637