Remote Code Execution Vulnerability in Webmin with Authentic Theme

CVE-2022-30708

What is CVE-2022-30708?

A vulnerability exists in Webmin versions up to 1.991 when the Authentic theme is in use, allowing for remote code execution. This issue arises from inadequate restrictions on the file parameter in the settings-editor_write.cgi component when a user is created manually, rather than through the Virtualmin or Cloudmin interfaces. Attackers leveraging this flaw could execute arbitrary code on the server, potentially leading to further exploits. It is advisable for users of affected versions to update their Webmin installations and review the associated security practices.

References