CVE-2019-15642

EPSS 38.0%◆ VulnCheck KEV

Vexday Risk Score

72High priority

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 38.0%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

26 Aug 2019Published on NVD

01 Sep 2019Public PoC

Weaponization speed

5 daysto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Patch as soon as possible — active exploitation confirmed.

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."

Affected products

n/a · n/a

public PoCs found — 1

vulncheckvulncheck.com/xdb/ec43688d5a2bunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://doxfer.webmin.com/Webmin/Webmin_Servers_Index https://github.com/webmin/webmin/blob/ab5e00e41ea1ecc1e24b8f8693f3495a0abb1aed/rpc.cgi#L26-L37 https://github.com/webmin/webmin/commit/df8a43fb4bdc9c858874f72773bcba597ae9432c https://www.calypt.com/blog/index.php/authenticated-rce-on-webmin/