CVE-2019-15107

Name of the Vulnerable Software and Affected Versions Webmin versions 1.882 through 1.921

Description An issue exists in the password change.cgi endpoint of the administration web interface. The old parameter is susceptible to command injection due to improper neutralization of special elements used in a command. This allows a remote attacker to execute arbitrary shell commands on the target system with root privileges without authentication by sending a malicious POST request. This issue was found in official builds distributed via Sourceforge.

Recommendations Update Webmin to version 1.930 or later. As a temporary mitigation, disable the option to change expired passwords. Restrict access to the password change.cgi endpoint to minimize the risk of exploitation.