CVE-2017-15645

EUVD-2017-7096
CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands.
CSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 76%
Affected Products (NVD)
VendorProductVersion
webminwebmin
𝑥
≤ 1.850
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.webmin.com/changes.html
http://www.webmin.com/security.html
https://blogs.securiteam.com/index.php/archives/3430
https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9
http://www.webmin.com/changes.html
http://www.webmin.com/security.html
https://blogs.securiteam.com/index.php/archives/3430
https://github.com/webmin/webmin/commit/0c58892732ee7610a7abba5507614366d382c9c9