PT-2012-4413 · Webmin · Webmin

Jcameron · Published 2012-09-11 · Updated 2013-05-30 · CVE-2012-2983

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Webmin versions 1.590 and earlier

Description The issue allows remote attackers to read arbitrary files without proper authorization. This is due to a lack of authorization check in the file/edit html.cgi component, which permits access to a file's unedited contents via the file field.

Recommendations For versions 1.590 and earlier, update to a version later than 1.590 to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-2983

Affected Products

Webmin

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/webmin/edit_html_fileaccess.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2983 · Security Note
• http://kb.cert.org/vuls/id/788478 · Patch
• https://github.com/webmin/webmin/commit/4cd7bad70e23e4e19be8ccf7b9f245445b2b3b80 · Note
• http://americaninfosec.com/research/index.html · Note
• http://xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf · Note
• http://securitytracker.com/id?1027507 · Note
• http://americaninfosec.com/research/dossiers/AISG-12-002.pdf · Note