// For flags

CVE-2019-15642

 

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."

rpc.cgi en Webmin hasta la version 1.920 permite la ejecución remota de código autenticada a través de un nombre de objeto diseñado porque unserialise_variable realiza una llamada de evaluación. NOTA: la documentación de Webmin_Servers_Index establece que "RPC se puede usar para ejecutar cualquier comando o modificar cualquier archivo en un servidor, por lo que no se debe otorgar acceso a los usuarios de Webmin que no son de confianza".

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-08-26 CVE Reserved
  • 2019-08-26 CVE Published
  • 2019-09-01 First Exploit
  • 2024-08-05 CVE Updated
  • 2024-08-19 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Webmin
Search vendor "Webmin"
Webmin
Search vendor "Webmin" for product "Webmin"
<= 1.920
Search vendor "Webmin" for product "Webmin" and version " <= 1.920"
-
Affected