| Package | Affected versions | Patched versions |
|---|---|---|
| cronicle | < 0.9.111 | 0.9.111 |
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.111, jb child processes can include an update_event key in their JSON output. The server applies this directly to the parent event's stored configuration without any authorization check. A low-privilege user who can create and run events can modify any event property, including webhook URLs and notification emails. This vulnerability is fixed in 0.9.111.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free