high8.8Public exploit code
CVE-2020-35606
Arbitrary command execution can occur in Webmin through 1.962.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Webmin 1.962 - 'Package Updates' Escape Bypass RCE (Metasploit)2020-12-22 · webapps · linux · Verified
Impact
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Webmin | Webmin | through 1.962 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/160676/Webmin-1.962-Remote-Command-Execution.html
- https://www.exploit-db.com/exploits/49318
- https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html
- https://www.webmin.com/download.html
- http://packetstormsecurity.com/files/160676/Webmin-1.962-Remote-Command-Execution.html
- https://www.exploit-db.com/exploits/49318
- https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html
- https://www.webmin.com/download.html