Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.910. It is, therefore, affected by a Remote Command Execution

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.920. It is, therefore, affected by a Remote Command Execution

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
113568	Webmin < 1.910 Remote Command Execution	Web App Scanning	Component Vulnerability	Version Based	high
113567	Webmin < 1.920 Remote Command Execution	Web App Scanning	Component Vulnerability	Version Based	high

Detections

Analytics

CVE-2019-9624

high

Tenable Plugins

high

high