CVE-2019-15107
Webmin Command Injection Vulnerability
Published Aug 15, 2019 · updated Aug 5, 2026 · webmin webmin
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
Timeline
Detection, updates, and resolution for this record.
Aug 15, 2019 · Catalog
Detected
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 5, 2026 · Catalog
Updated
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe webmin/webminversion unspecified
- vendor Webmin Webminversion unspecified
Sources
- AttackerKBhttps://attackerkb.com/topics/hxx3zmiCkR/webmin-password-change-cgi-command-injection
AttackerKB link already published on the finding.
attackerkb.com - CISA KEVCVE-2019-15107
An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
cisa.gov - CVE.orgCVE-2019-15107
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-15107
30-day exploitation probability 99.7%
first.org - Exploit Database47230
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database47293
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_linux/http/webmin_backdoor
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2019-15107
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/154141/Webmin-1.920-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/154197/Webmin-1.920-password_change.cgi-Backdoor.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/154485/Webmin-1.920-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com