// For flags

CVE-2019-15107

Webmin Command Injection Vulnerability

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

29
*Multiple Sources

Exploited in Wild

Yes
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Se ha detectado un problema en Webmin menor o igual a la versión 1.920. El parámetro old en password_change.cgi contiene una vulnerabilidad de inyección de comandos.

An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-08-15 CVE Reserved
  • 2019-08-16 CVE Published
  • 2019-08-19 First Exploit
  • 2022-03-25 Exploited in Wild
  • 2022-04-15 KEV Due Date
  • 2024-08-05 CVE Updated
  • 2024-10-02 EPSS Updated
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (36)
URL Tag Source
http://packetstormsecurity.com/files/154485/Webmin-1.920-Remote-Code-Execution.html Third Party Advisory
https://attackerkb.com/topics/hxx3zmiCkR/webmin-password-change-cgi-command-injection Third Party Advisory
http://www.webmin.com/exploit.html
https://pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html
https://blog.firosolutions.com/exploits/webmin
https://github.com/webmin/webmin/issues/947
URL Date SRC
https://www.exploit-db.com/exploits/47230 2024-08-05
https://www.exploit-db.com/exploits/47293 2019-08-19
https://github.com/jas502n/CVE-2019-15107 2019-09-02
https://github.com/MuirlandOracle/CVE-2019-15107 2024-06-01
https://github.com/AdministratorGithub/CVE-2019-15107 2019-08-23
https://github.com/ruthvikvegunta/CVE-2019-15107 2020-08-12
https://github.com/AleWong/WebminRCE-EXP-CVE-2019-15107- 2019-11-01
https://github.com/K3ysTr0K3R/CVE-2019-15107-EXPLOIT 2024-01-09
https://github.com/ketlerd/CVE-2019-15107 2019-08-24
https://github.com/wenruoya/CVE-2019-15107 2023-03-10
https://github.com/whokilleddb/CVE-2019-15107 2021-10-02
https://github.com/f0rkr/CVE-2019-15107 2022-04-18
https://github.com/g1vi/CVE-2019-15107 2023-03-31
https://github.com/h4ck0rman/CVE-2019-15107 2023-08-25
https://github.com/darrenmartyn/CVE-2019-15107 2021-09-09
https://github.com/diegojuan/CVE-2019-15107 2020-12-03
https://github.com/lolminerxmrig/CVE-2019-15107 2022-06-30
https://github.com/ianxtianxt/CVE-2019-15107 2019-12-15
https://github.com/olingo99/CVE-2019-15107 2023-11-09
https://github.com/0x4r2/Webmin-CVE-2019-15107 2023-12-12
https://github.com/hacknotes/CVE-2019-15107-Exploit 2021-10-16
https://github.com/cdedmondson/Modified-CVE-2019-15107 2021-02-13
https://github.com/aamfrk/Webmin-CVE-2019-15107 2024-04-28
https://github.com/gozn/detect-CVE-2019-15107-by-pyshark 2023-10-26
https://github.com/NasrallahBaadi/CVE-2019-15107 2024-08-29
http://packetstormsecurity.com/files/154141/Webmin-1.920-Remote-Command-Execution.html 2024-08-05
http://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html 2024-08-05
http://packetstormsecurity.com/files/154197/Webmin-1.920-password_change.cgi-Backdoor.html 2024-08-05
http://www.pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html 2024-08-05
URL Date SRC
URL Date SRC
http://www.webmin.com/security.html 2023-02-28
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Webmin
Search vendor "Webmin"
 Webmin
Search vendor "Webmin" for product "Webmin"
 <= 1.920
Search vendor "Webmin" for product "Webmin" and version " <= 1.920"
-
Affected