High severity · published Jun 15, 2019
CVE-2019-12840
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi
8.8
CVSS
77.6%
EPSS
No
On KEV
Description
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)77.6% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmin · Webmin
through 1.910 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-12840
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-12840
packetstormsecurity.com
http://packetstormsecurity.com/files/153372/Webmin-1.910-Remote-Command-Execution.html
www.securityfocus.com
http://www.securityfocus.com/bid/108790
Exploit
https://pentest.com.tr/exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html
Exploit
https://www.exploit-db.com/exploits/46984
More from Webmin
9.8
CVE-2019-15107
Webmin Command Injection Vulnerability
9.8
CVE-2022-36446
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command
9.8
CVE-2020-35769
miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program
9.8
CVE-2018-8712
An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled
9.6
CVE-2026-49243
Webmin: Reflected XSS in the Configuration module