What’s Vulnerable › Vulnerabilities
CVE-2022-0824: Improper Access Control to Remote Code Execution in webmin/webmin
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 97.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-03-02 · updated 2026-06-17
- Weakness: CWE-284
Description
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.
Affected products
- Webmin: before 1.990 — fixed in 1.990
How to fix
Upgrade to a fixed version: Webmin 1.990. Check the vendor advisory for mitigations.
References
- http://packetstormsecurity.com/files/166240/Webmin-1.984-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/169700/Webmin-1.984-File-Manager-Remote-Code-Execution.html
- https://github.com/webmin/webmin/commit/39ea464f0c40b325decd6a5bfb7833fa4a142e38
- https://huntr.dev/bounties/d0049a96-de90-4b1a-9111-94de1044f295
- https://notes.netbytesec.com/2022/03/webmin-broken-access-control-to-post-auth-rce.html
- http://packetstormsecurity.com/files/166240/Webmin-1.984-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/169700/Webmin-1.984-File-Manager-Remote-Code-Execution.html
- https://github.com/webmin/webmin/commit/39ea464f0c40b325decd6a5bfb7833fa4a142e38
- https://huntr.dev/bounties/d0049a96-de90-4b1a-9111-94de1044f295
- https://notes.netbytesec.com/2022/03/webmin-broken-access-control-to-post-auth-rce.html
Get alerted when CVE-2022-0824 or the next vulnerability affects your stack