CVE-2013-3632
HighSummary
The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.
Risk Assessment
This vulnerability may lead to unauthorized access to the system and execution of malicious commands, posing a serious security threat to the organization.
Recommendation
It is recommended to restrict access to the Cron service and update OpenMediaVault to the latest version to mitigate this vulnerability.
Other vulnerabilities in OpenMediaVault
See all- CVE-2026-52102Critical
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters.
- CVE-2025-50674High
In OpenMediaVault 7.4.17, a vulnerability was discovered in the changePassword method in file /usr/share/php/openmediavault/system/user.inc, allowing local authenticated attackers to escalate privileges to root.
Original NVD description (English source)
The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.