CVE-2018-19793

Name of the Vulnerable Software and Affected Versions jiacrontab version 1.4.5

Description The issue allows remote attackers to execute arbitrary commands. This can be achieved via the crontab/task/edit API endpoint, specifically by manipulating the command and args parameters in the POST data. For example, setting command=cat and args=/etc/passwd can lead to the execution of unwanted commands.

Recommendations For jiacrontab version 1.4.5, as a temporary workaround, consider restricting access to the crontab/task/edit API endpoint until a patch is available. Avoid using the command and args parameters in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.