CVE-2022-30708 - Vulnerability Details - OpenCVE

Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.05421.

Key SSVC decision points have not yet been added.

Vendors	Products
Webmin	Webmin

Configuration 1 [-]

cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-52538	Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/esp0xdeadbeef/rce_webmin
https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py
https://github.com/webmin/authentic-theme/releases
https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d
https://github.com/webmin/webmin/issues/1635
https://github.com/webmin/webmin/releases
https://webmin.com/changes.html
https://www.twitch.tv/videos/1483029790

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-05-15T02:30:14

Updated: 2024-08-03T06:56:13.713Z

Reserved: 2022-05-15T00:00:00

Link: CVE-2022-30708

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-05-15T03:15:07.060

Modified: 2024-11-21T07:03:13.387

Link: CVE-2022-30708

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-05-15T02:30:14", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/webmin/webmin/issues/1635"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/esp0xdeadbeef/rce_webmin"}, {"tags": ["x_refsource_MISC"], "url": "https://www.twitch.tv/videos/1483029790"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/webmin/webmin/releases"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/webmin/authentic-theme/releases"}, {"tags": ["x_refsource_MISC"], "url": "https://webmin.com/changes.html"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2022-30708", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://github.com/webmin/webmin/issues/1635", "refsource": "MISC", "url": "https://github.com/webmin/webmin/issues/1635"}, {"name": "https://github.com/esp0xdeadbeef/rce_webmin", "refsource": "MISC", "url": "https://github.com/esp0xdeadbeef/rce_webmin"}, {"name": "https://www.twitch.tv/videos/1483029790", "refsource": "MISC", "url": "https://www.twitch.tv/videos/1483029790"}, {"name": "https://github.com/webmin/webmin/releases", "refsource": "MISC", "url": "https://github.com/webmin/webmin/releases"}, {"name": "https://github.com/webmin/authentic-theme/releases", "refsource": "MISC", "url": "https://github.com/webmin/authentic-theme/releases"}, {"name": "https://webmin.com/changes.html", "refsource": "MISC", "url": "https://webmin.com/changes.html"}, {"name": "https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d", "refsource": "MISC", "url": "https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d"}, {"name": "https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py", "refsource": "MISC", "url": "https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:56:13.713Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/webmin/webmin/issues/1635"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/esp0xdeadbeef/rce_webmin"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.twitch.tv/videos/1483029790"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/webmin/webmin/releases"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/webmin/authentic-theme/releases"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://webmin.com/changes.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2022-30708", "datePublished": "2022-05-15T02:30:14", "dateReserved": "2022-05-15T00:00:00", "dateUpdated": "2024-08-03T06:56:13.713Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:*", "matchCriteriaId": "E7E66E77-42F1-435A-A63C-00C63E08F2AF", "versionEndIncluding": "1.991", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter."}, {"lang": "es", "value": "Webmin versiones hasta 1.991, cuando es usado el tema Authentic, permite una ejecuci\u00f3n de c\u00f3digo remota cuando un usuario ha sido creado manualmente (es decir, no ha sido creado en Virtualmin o Cloudmin). Esto ocurre porque settings-editor_write.cgi no restringe apropiadamente el par\u00e1metro de archivo"}], "id": "CVE-2022-30708", "lastModified": "2024-11-21T07:03:13.387", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-15T03:15:07.060", "references": [{"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/esp0xdeadbeef/rce_webmin"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/webmin/authentic-theme/releases"}, {"source": "cve@mitre.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/issues/1635"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/releases"}, {"source": "cve@mitre.org", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://webmin.com/changes.html"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.twitch.tv/videos/1483029790"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/esp0xdeadbeef/rce_webmin"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/webmin/authentic-theme/releases"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/issues/1635"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/webmin/webmin/releases"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://webmin.com/changes.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://www.twitch.tv/videos/1483029790"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}