NVD Vulnerability Detail

CVE-2022-30708

Summary	Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.
Publication Date	May 15, 2022, 12:15 p.m.
Registration Date	May 15, 2022, 4 p.m.
Last Update	Nov. 21, 2024, 4:03 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:webmin:webmin::::::::			1.991

Related information, measures and tools

No	URL	タグ
1	https://github.com/esp0xdeadbeef/rce_webmin	Exploit Third Party Advisory
2	https://github.com/esp0xdeadbeef/rce_webmin	Exploit Third Party Advisory
3	https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py	Exploit Third Party Advisory
4	https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py	Exploit Third Party Advisory
5	https://github.com/webmin/authentic-theme/releases	Release Notes Third Party Advisory
6	https://github.com/webmin/authentic-theme/releases	Release Notes Third Party Advisory
7	https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d	Patch Third Party Advisory
8	https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d	Patch Third Party Advisory
9	https://github.com/webmin/webmin/issues/1635	Issue Tracking Third Party Advisory
10	https://github.com/webmin/webmin/issues/1635	Issue Tracking Third Party Advisory
11	https://github.com/webmin/webmin/releases	Release Notes Third Party Advisory
12	https://github.com/webmin/webmin/releases	Release Notes Third Party Advisory
13	https://webmin.com/changes.html	Release Notes Vendor Advisory
14	https://webmin.com/changes.html	Release Notes Vendor Advisory
15	https://www.twitch.tv/videos/1483029790	Exploit Third Party Advisory
16	https://www.twitch.tv/videos/1483029790	Exploit Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Webmin Project の Webmin における脆弱性

Title	Webmin Project の Webmin における脆弱性
Summary	Webmin Project の Webmin には、不特定の脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダアドバイザリまたはパッチ情報が公開されています。参考情報を参照して適切な対策を実施してください。
Publication Date	May 15, 2022, midnight
Registration Date	Aug. 8, 2023, 5:18 p.m.
Last Update	Aug. 8, 2023, 5:18 p.m.

Affected System

Webmin Project

Webmin 1.991 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2022-30708	https://www.cve.org/CVERecord?id=CVE-2022-30708
National Vulnerability Database (NVD)
2	CVE-2022-30708	https://nvd.nist.gov/vuln/detail/CVE-2022-30708

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/scap/cwe.html

その他

No	Name	URL
関連文書
1	github.com (6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d)	https://github.com/webmin/webmin/commit/6a2334bf8b27d55c7edf0b2825cd14f3f8a69d4d
2	github.com (exploit.py)	https://github.com/esp0xdeadbeef/rce_webmin/blob/main/exploit.py
3	github.com (issues/1635)	https://github.com/webmin/webmin/issues/1635
4	github.com (rce_webmin)	https://github.com/esp0xdeadbeef/rce_webmin
5	github.com (releases)	https://github.com/webmin/authentic-theme/releases
6	github.com (releases)	https://github.com/webmin/webmin/releases
7	webmin.com (changes)	https://webmin.com/changes.html
8	www.twitch.tv (videos/1483029790)	https://www.twitch.tv/videos/1483029790

Change Log

No	Changed Details	Date of change
1	[2023年08月08日] 掲載	Aug. 8, 2023, 5:18 p.m.