PT-2024-5735 · Webmin+1 · Webmin+1

Toshitsugu Yoneyama · Published 2024-07-09 · Updated 2025-10-08 · CVE-2024-36452

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 2.003

Description A cross-site request forgery vulnerability exists in the ajaxterm module. If exploited, unintended operations may be performed when a user views a malicious page while logged in, potentially allowing data within a system to be referred, a webpage to be altered, or a server to be permanently halted.

Recommendations For versions prior to 2.003, update to version 2.003 or later to resolve the issue. As a temporary workaround, consider disabling the ajaxterm module until a patch is available. Restrict access to the ajaxterm module to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-06448

CVE-2024-36452

Affected Products

Red Os

Webmin

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2024-36452 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36452 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06448 · Security Note
• https://t.me/cvenotify/85668 · Telegram Post
• https://jvn.jp/en/jp/JVN81442045 · Note
• https://twitter.com/VulmonFeeds/status/1810988826904371551 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-webmin-18-09-24 · Note
• https://t.me/cvedetector/517 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024071529 · Note
• https://t.me/cveNotify/137835 · Telegram Post
• https://twitter.com/CVEnew/status/1810944898419544121 · Twitter Post
• https://webmin.com · Note