An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

According to its self-reported version, the Webmin install hosted on the remote host is 1.890 to 1.920. It is, therefore, affected by a remote command execution vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

A remote code execution vulnerability exists in reset password component due to an insecure default configuration. An unauthenticated, remote attacker can exploit this  to bypass authentication and execute arbitrary commands with root privileges.

Joe Cooper reports :

I've rolled out Webmin version 1.930 and Usermin version 1.780 for all repositories. This release includes several security fixes, including one potentially serious one caused by malicious code inserted into Webmin and Usermin at some point on our build infrastructure. We're still investigating how and when, but the exploitable code has never existed in our github repositories, so we've rebuilt from git source on new infrastructure (and checked to be sure the result does not contain the malicious code).

I don't have a changelog for these releases yet, but I wanted to announce them immediately due to the severity of this issue. To exploit the malicious code, your Webmin installation must have Webmin
-> Webmin Configuration -> Authentication -> Password expiry policy set to Prompt users with expired passwords to enter a new one. This option is not set by default, but if it is set, it allows remote code execution.

This release addresses CVE-2019-15107, which was disclosed earlier today. It also addresses a handful of XSS issues that we were notified about, and a bounty was awarded to the researcher (a different one) who found them.

The Webmin install hosted on the remote host is affected by a remote command execution vulnerability. A remote, unauthenticated attacker and exploit this to execute arbitrary commands on the remote host.

ID	Name	Product	Family	Severity
113566	Webmin < 1.930 Remote Command Execution	Web App Scanning	Component Vulnerability	critical
98670	Webmin 1.890 < 1.930 Remote Command Execution	Web App Scanning	Component Vulnerability	critical
128280	Webmin < 1.930 Remote Code Execution Vulnerability	Nessus	Misc.	critical
127954	FreeBSD : webmin -- unauthenticated remote code execution (ece65d3b-c20c-11e9-8af4-bcaec55be5e5)	Nessus	FreeBSD Local Security Checks	critical
127911	Webmin 1.890 - 1.920 Remote Command Execution (CVE-2019-15107, CVE-2019-15231)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-15107

critical

Tenable Plugins

critical

critical

critical

critical

critical