CVE-2019-15642

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call

published August 26, 2019

CVSS
—
EPSS
35%
Percentile
98.4
In the wild
Unconfirmed
What it is

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.34798 · 98.4th percentile
Published
2019-08-26T17:07Z
EPSS history
Timeline
  • 22 SEP 03:17Z
    EPSS moved 35% → 13%
    epss
  • 06 SEP 03:13Z
    EPSS moved 35% → 13%
    epss
  • 30 AUG 16:02Z
    EPSS moved 13% → 35%
    epss
  • 29 AUG 04:48Z
    EPSS moved 35% → 13%
    epss
  • 26 AUG 17:07Z
    rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call
    cvelistv5