In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the da…

Published 7 y ago 2019-06-15 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

77.6%

percentile 100%

Public exploits

Metasploit · Exploit-DB

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.

Exploit prediction (EPSS)

77.65% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

Metasploit exploit/linux/http/webmin_packageup_rce Webmin Package Updates Remote Command Execution · metasploit exploit, excellent rank · 2019-05-16
EDB-46984 Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit) · remote · 2019-06-11

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	9.0	`AV:N/AC:L/Au:S/C:C/I:C/A:C`

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

exploit-db.com /exploits/46984 · x_refsource_MISC, x_transferred
pentest.com.tr /exploits/Webmin-1910-Package-Updates-Remote-Command-Execution.html · x_refsource_MISC, x_transferred
securityfocus.com /bid/108790 · vdb-entry, x_refsource_BID, x_transferred
packetstormsecurity.com /files/153372/Webmin-1.910-Remote-Command-Execution.html · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2019-12840
NVD: CVE-2019-12840

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.