SB2020051302 - Remote command execution in Webmin

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020051302

SB2020051302 - Remote command execution in Webmin

Published: May 13, 2020

Security Bulletin ID SB2020051302
CSH Severity
Medium
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) OS Command Injection (CVE-ID: N/A)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Green


The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing file names within the "/cpan/download.cgi" script. A remote authenticated user with permissions to install Perl modules can pass specially crafted data via the file name during file upload and execute arbitrary OS commands on the target system.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References