PT-2021-19494 · Webmin · Webmin

Mesh3L_911 + 1 · Published 2021-04-25 · Updated 2021-04-28 · CVE-2021-31760

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webmin version 1.973

Description The issue allows for Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature. This means an attacker could potentially execute commands on a remote system without proper authorization.

Recommendations For Webmin version 1.973, consider disabling the running process feature as a temporary workaround until a patch is available. Restrict access to Webmin's running process feature to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-31760

Affected Products

Webmin

References · 8

• 🔥 https://github.com/electronicbots/CVE-2021-31760 · Exploit
• 🔥 https://github.com/Mesh3l911/CVE-2021-31760 · Exploit
• 🔥 https://youtu.be/D45FN8QrzDo · Exploit
• https://osv.dev/vulnerability/CVE-2021-31760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31760 · Security Note
• https://github.com/webmin/webmin · Note
• https://t.me/cvenotify/13682 · Telegram Post
• https://t.me/cybersecuritytechnologies/3207 · Telegram Post