High severity · published Dec 30, 2024
CVE-2024-12828
Webmin CGI Command Injection Remote Code Execution Vulnerability
8.8
CVSS
33.3%
EPSS
No
On KEV
Description
Webmin CGI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Webmin. Authentication is required to exploit this vulnerability.
The specific flaw exists within the handling of CGI requests. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22346.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)33.3% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmin · Webmin
webmin 2.104 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-12828
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-12828
Patch
https://github.com/webmin/authentic-theme/commit/61e5b10227b50407e3c6ac494ffbd4385d1b59df
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-1725/
More from Webmin
9.8
CVE-2019-15107
Webmin Command Injection Vulnerability
9.8
CVE-2022-36446
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command
9.8
CVE-2020-35769
miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program
9.8
CVE-2018-8712
An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled
9.6
CVE-2026-49243
Webmin: Reflected XSS in the Configuration module