CVE-2019-9624 - Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI

Back Back to CVE browser

HIGH

Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI

Published Mar 7, 2019

7.8

HIGH

CVSS 3.0

EPSS 23.69%

Description

Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (4)

http://www.rapid7.com/db/modules/exploit/unix/webapp/webmin_upload_exec
x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-18995
Advisory
https://pentest.com.tr/exploits/Webmin-1900-Remote-Command-Execution.html
x_refsource_MISCExploitThird Party Advisory
https://www.exploit-db.com/exploits/46201
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://www.rapid7.com/db/modules/exploit/unix/webapp/webmin_upload_exec		x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-18995		Advisory
https://pentest.com.tr/exploits/Webmin-1900-Remote-Command-Execution.html		x_refsource_MISCExploitThird Party Advisory
https://www.exploit-db.com/exploits/46201		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry