PT-2022-4098 · Webmin · Webmin

Emir Polat · Published 2022-07-25 · Updated 2025-11-13 · CVE-2022-36446

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 1.997

Description The issue is related to a lack of HTML escaping for a UI command in the software/apt-lib.pl component of Webmin, allowing a remote attacker to execute arbitrary code.

Recommendations For versions prior to 1.997, update to version 1.997 or later to resolve the issue. As a temporary workaround, consider restricting access to the software/apt-lib.pl component until a patch is available.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

BDU:2022-04933

CVE-2022-36446

Affected Products

Webmin

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webmin_package_updates_rce.rb · Exploit
• 🔥 https://github.com/p0dalirius/CVE-2022-36446-Webmin-Software-Package-Updates-RCE · Exploit
• 🔥 https://github.com/emirpolatt/CVE-2022-36446 · Exploit
• 🔥 https://gist.github.com/emirpolatt/cf19d6c0128fa3e25ebb47e09243919b · Exploit
• 🔥 https://exploit-db.com/exploits/50998 · Exploit
• 🔥 http://packetstormsecurity.com/files/168049/Webmin-Package-Updates-Command-Injection.html · Exploit
• https://github.com/webmin/webmin/commit/13f7bf9621a82d93f1e9dbd838d1e22020221bde · Patch
• https://osv.dev/vulnerability/CVE-2022-36446 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36446 · Security Note
• https://bdu.fstec.ru/vul/2022-04933 · Security Note
• https://github.com/webmin/webmin/compare/1.996...1.997 · Note
• https://t.me/cvenotify/33712 · Telegram Post
• https://t.me/freedomf0x/17135 · Telegram Post
• http://packetstormsecurity.com/files/167894/Webmin-1.996-Remote-Code-Execution.html · Note
• https://t.me/poxek/2337 · Telegram Post