Vulnerability Details : CVE-2012-2982
Public exploit exists!
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.
Exploit prediction scoring system (EPSS) score for CVE-2012-2982
Probability of exploitation activity in the next 30 days: 97.34%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2012-2982
-
Webmin /file/show.cgi Remote Command Execution
Disclosure Date: 2012-09-06First seen: 2020-04-26exploit/unix/webapp/webmin_show_cgi_execThis module exploits an arbitrary command execution vulnerability in Webmin 1.580. The vulnerability exists in the /file/show.cgi component and allows an authenticated user, with access to the File Manager Module, to execute arbitrary commands with root privileges.
CVSS scores for CVE-2012-2982
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST |
References for CVE-2012-2982
- http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
-
https://github.com/webmin/webmin/commit/1f1411fe7404ec3ac03e803cfa7e01515e71a213
Prevent use of commands in filename to show https://sourceforge.net/t… · webmin/webmin@1f1411f · GitHubExploit;Patch
-
http://americaninfosec.com/research/index.html
404 Not Found
-
http://www.kb.cert.org/vuls/id/788478
VU#788478 - Webmin contains input validation vulnerabilitiesPatch;US Government Resource
- http://www.americaninfosec.com/research/dossiers/AISG-12-001.pdf
-
http://www.securitytracker.com/id?1027507
Webmin Flaws Let Remote Authenticated Users Execute Arbitrary Code and View Arbitrary Files - SecurityTracker
Products affected by CVE-2012-2982
- cpe:2.3:a:gentoo:webmin:*:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.150:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.160:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.140:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.570:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.550:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.450:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.440:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.370:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.340:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.270:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.560:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.530:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.430:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.420:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.330:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.320:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.240:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.230:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.520:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.510:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.410:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.400:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.310:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.300:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.220:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.210:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.200:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.260:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.580:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.500:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.480:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.470:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.390:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.380:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.290:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.280:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.180:*:*:*:*:*:*:*
- cpe:2.3:a:gentoo:webmin:1.170:*:*:*:*:*:*:*