CRITICAL🚩 CISA KEV⚡ EXPLOIT🇵🇱 Wersja polska

CVE-2019-15107

CVSS 9.8v3.1pub. 2019-08-16upd. 2026-08-06

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Webmin

    APP
    Webmin
    ≤ 1.920

CISA KEV — detailsi

Vendori
Webmin
Producti
Webmin
Added to KEVi
March 25, 2022
Remediation deadline (US Federal)i
April 15, 2022(overdue)
Ransomwarei
Active ransomware campaigns exploit this vulnerability
Required action (CISA)i

Apply updates per vendor instructions.

CISA descriptioni

An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.

🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
☠️WYKORZYSTYWANE W RANSOMWARE⏰CISA DEADLINE: 15 kwietnia 2022
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2022-36446CRITICAL9.8PL ✓same product

Webmin – brak HTML escaping umożliwia RCE przez command injection

CVE-2021-32157CRITICAL9.6PL ✓same product

XSS w Webmin 1.973 — funkcja Scheduled Cron Jobs

CVE-2021-31761CRITICAL9.6PL ✓same product

Webmin 1.973 — reflected XSS prowadzący do Remote Command Execution

CVE-2020-35769CRITICAL9.8PL ✓same product

Webmin 1.962 (Windows): błędna obsługa znaków specjalnych w miniserv.pl

CVE-2018-8712CRITICAL9.8PL ✓same product

Webmin 1.840/1.880 — path traversal umożliwia odczyt plików systemowych