PT-2020-17415 · Webmin · Webmin

Published 2020-12-29 · Updated 2022-07-17 · CVE-2020-35769

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webmin version 1.962

Description The issue concerns the miniserv.pl component in Webmin, which mishandles special characters in query arguments to the CGI program. This can be exploited when sending queries to the miniserv.pl CGI endpoint, potentially allowing for malicious actions due to the improper handling of special characters in query arguments.

Recommendations For Webmin version 1.962, consider disabling the miniserv.pl CGI program until a patch is available to prevent potential exploitation due to the mishandling of special characters in query arguments. Restrict access to the miniserv.pl component to minimize the risk of exploitation. Avoid using special characters in query arguments to the affected CGI program until the issue is resolved.

Fix

Related Identifiers

CVE-2020-35769

Affected Products

Webmin

References · 6

• https://github.com/webmin/webmin/commit/1163f3a7f418f249af64890f4636575e687e9de7#diff-9b33fd8f5603d4f0d1428689bc36f24af4770608a22c0d92b7a8bcc522450dc6 · Patch
• https://osv.dev/vulnerability/CVE-2020-35769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35769 · Security Note
• https://vigilance.fr/vulnerability/Webmin-code-execution-via-miniserv-pl-handle-request-34220 · Patch
• https://t.me/cibsecurity/21375 · Telegram Post
• https://t.me/cvenotify/7858 · Telegram Post