{"id":"CVE-2019-15107","aliases":["EUVD-2019-6178","GHSA-69hp-hrv4-rxrr","MGASA-2019-0237"],"status":"published","title":"An issue was discovered in Webmin through 1.920. The parameter old in password_change.cgi...","description":"An issue was discovered in Webmin \u003c=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.9971,"percentile":0.99952,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-78"],"published":"2019-08-16T02:44:04Z","modified":"2026-10-24T10:30:31Z","kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-03-25"},{"source":"kev","since":"2022-03-25"}],"exploits":[{"source":"metasploit","id":"exploit/linux/http/webmin_backdoor","title":"Webmin password_change.cgi Backdoor","type":"exploit","platform":"Linux,Unix","date":"2019-08-10","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/webmin_backdoor"},{"source":"exploitdb","id":"EDB-47230","title":"Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)","type":"remote","platform":"linux","date":"2019-08-12","verified":true,"url":"https://www.exploit-db.com/exploits/47230"},{"source":"exploitdb","id":"EDB-47293","title":"Webmin 1.920 - Remote Code Execution","type":"webapps","platform":"linux","date":"2019-08-19","url":"https://www.exploit-db.com/exploits/47293"},{"source":"pocgithub","id":"jas502n/CVE-2019-15107","title":"jas502n/CVE-2019-15107","date":"2019-08-19","url":"https://github.com/jas502n/CVE-2019-15107"},{"source":"pocgithub","id":"HACHp1/webmin_docker_and_exp","title":"HACHp1/webmin_docker_and_exp","date":"2019-08-22","url":"https://github.com/HACHp1/webmin_docker_and_exp"},{"source":"pocgithub","id":"ketlerd/CVE-2019-15107","title":"ketlerd/CVE-2019-15107","date":"2019-08-22","url":"https://github.com/ketlerd/CVE-2019-15107"},{"source":"pocgithub","id":"AdministratorGithub/CVE-2019-15107","title":"AdministratorGithub/CVE-2019-15107","date":"2019-08-23","url":"https://github.com/AdministratorGithub/CVE-2019-15107"},{"source":"pocgithub","id":"Rayferrufino/Make-and-Break","title":"Rayferrufino/Make-and-Break","date":"2019-09-23","url":"https://github.com/Rayferrufino/Make-and-Break"},{"source":"pocgithub","id":"AleWong/WebminRCE-EXP-CVE-2019-15107-","title":"AleWong/WebminRCE-EXP-CVE-2019-15107-","date":"2019-10-24","url":"https://github.com/AleWong/WebminRCE-EXP-CVE-2019-15107-"},{"source":"pocgithub","id":"ianxtianxt/CVE-2019-15107","title":"ianxtianxt/CVE-2019-15107","date":"2019-12-15","url":"https://github.com/ianxtianxt/CVE-2019-15107"},{"source":"pocgithub","id":"hannob/webminex","title":"hannob/webminex","date":"2019-12-25","url":"https://github.com/hannob/webminex"},{"source":"pocgithub","id":"ch4ko/webmin_CVE-2019-15107","title":"ch4ko/webmin_CVE-2019-15107","date":"2019-12-29","url":"https://github.com/ch4ko/webmin_CVE-2019-15107"},{"source":"pocgithub","id":"cdedmondson/Modified-CVE-2019-15107","title":"cdedmondson/Modified-CVE-2019-15107","date":"2020-06-20","url":"https://github.com/cdedmondson/Modified-CVE-2019-15107"},{"source":"pocgithub","id":"ruthvikvegunta/CVE-2019-15107","title":"ruthvikvegunta/CVE-2019-15107","date":"2020-08-08","url":"https://github.com/ruthvikvegunta/CVE-2019-15107"},{"source":"pocgithub","id":"n0obit4/Webmin_1.890-POC","title":"n0obit4/Webmin_1.890-POC","date":"2020-09-13","url":"https://github.com/n0obit4/Webmin_1.890-POC"},{"source":"pocgithub","id":"squid22/Webmin_CVE-2019-15107","title":"squid22/Webmin_CVE-2019-15107","date":"2020-10-15","url":"https://github.com/squid22/Webmin_CVE-2019-15107"},{"source":"pocgithub","id":"MuirlandOracle/CVE-2019-15107","title":"MuirlandOracle/CVE-2019-15107","date":"2020-11-09","url":"https://github.com/MuirlandOracle/CVE-2019-15107"},{"source":"pocgithub","id":"diegojuan/CVE-2019-15107","title":"diegojuan/CVE-2019-15107","date":"2020-12-03","url":"https://github.com/diegojuan/CVE-2019-15107"},{"source":"pocgithub","id":"whokilleddb/CVE-2019-15107","title":"whokilleddb/CVE-2019-15107","date":"2021-07-02","url":"https://github.com/whokilleddb/CVE-2019-15107"},{"source":"pocgithub","id":"darrenmartyn/CVE-2019-15107","title":"darrenmartyn/CVE-2019-15107","date":"2021-09-09","url":"https://github.com/darrenmartyn/CVE-2019-15107"},{"source":"pocgithub","id":"hacknotes/CVE-2019-15107-Exploit","title":"hacknotes/CVE-2019-15107-Exploit","date":"2021-10-05","url":"https://github.com/hacknotes/CVE-2019-15107-Exploit"},{"source":"pocgithub","id":"CyberTuz/CVE-2019-15107_detection","title":"CyberTuz/CVE-2019-15107_detection","date":"2021-10-10","url":"https://github.com/CyberTuz/CVE-2019-15107_detection"},{"source":"pocgithub","id":"hadrian3689/webmin_1.920","title":"hadrian3689/webmin_1.920","date":"2022-02-21","url":"https://github.com/hadrian3689/webmin_1.920"},{"source":"pocgithub","id":"f0rkr/CVE-2019-15107","title":"f0rkr/CVE-2019-15107","date":"2022-04-18","url":"https://github.com/f0rkr/CVE-2019-15107"},{"source":"pocgithub","id":"psw01/CVE-2019-15107_webminRCE","title":"psw01/CVE-2019-15107_webminRCE","date":"2022-06-17","url":"https://github.com/psw01/CVE-2019-15107_webminRCE"},{"source":"pocgithub","id":"TheAlpha19/MiniExploit","title":"TheAlpha19/MiniExploit","date":"2022-07-26","url":"https://github.com/TheAlpha19/MiniExploit"},{"source":"pocgithub","id":"wenruoya/CVE-2019-15107","title":"wenruoya/CVE-2019-15107","date":"2023-03-09","url":"https://github.com/wenruoya/CVE-2019-15107"},{"source":"pocgithub","id":"g1vi/CVE-2019-15107","title":"g1vi/CVE-2019-15107","date":"2023-03-31","url":"https://github.com/g1vi/CVE-2019-15107"},{"source":"nuclei","id":"CVE-2019-15107","title":"Webmin \u003c= 1.920 - Unauthenticated Remote Command Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-15107.yaml"}],"exploits_more":17,"fixes":[{"ecosystem":"Mageia:7","package":"webmin","fixed_in":["1.930-1.mga7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:7","package":"webmin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.930-1.mga7"}]}]}],"products":[{"vendor":"webmin","product":"webmin"}],"references":[{"url":"http://www.webmin.com/security.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.exploit-db.com/exploits/47230","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://www.pentest.com.tr/exploits/DEFCON-Webmin-1920-Unauthenticated-Remote-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/154141/Webmin-Remote-Comman-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/154141/Webmin-1.920-Remote-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/154197/Webmin-1.920-password_change.cgi-Backdoor.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"http://packetstormsecurity.com/files/154485/Webmin-1.920-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://attackerkb.com/topics/hxx3zmiCkR/webmin-password-change-cgi-command-injection","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-15107","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15107"},{"url":"https://github.com/advisories/GHSA-69hp-hrv4-rxrr"},{"url":"https://advisories.mageia.org/MGASA-2019-0237.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25331","tags":["report"]},{"url":"http://www.webmin.com/changes.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-15107","description":"An issue was discovered in Webmin \u003c=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.","status":"published","published":"2019-08-16T02:44:04Z","modified":"2026-08-06T03:55:32.205Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:21.397307Z"}],"euvd":[{"id":"EUVD-2019-6178","description":"An issue was discovered in Webmin \u003c=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.","status":"published","published":"2019-08-16T02:44:04Z","modified":"2026-08-06T03:55:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-03-25","updated_at":"2026-11-02T18:02:09.043832Z"}],"ghsa":[{"id":"GHSA-69hp-hrv4-rxrr","title":"An issue was discovered in Webmin through 1.920. The parameter old in password_change.cgi...","description":"An issue was discovered in Webmin through 1.920. The parameter old in password_change.cgi contains a command injection vulnerability.","status":"published","published":"2022-05-24T16:53:49Z","modified":"2025-10-22T00:32:47Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2019-15107","title":"Webmin Command Injection Vulnerability","description":"An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.","cwes":["CWE-78"],"kev":{"date_added":"2022-03-25","due_date":"2022-04-15","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2019-15107","description":"An issue was discovered in Webmin \u003c=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.","status":"published","published":"2019-08-16T03:15:11.387Z","modified":"2026-08-06T05:16:35.14Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:22.878504Z"}],"osv":[{"id":"CVE-2019-15107","description":"An issue was discovered in Webmin \u003c=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.","status":"published","published":"2019-08-16T03:15:11.387Z","modified":"2026-10-24T10:30:31.133716356Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"MGASA-2019-0237","title":"Updated webmin packages fix security vulnerability","description":"Updated webmin package fixes security vulnerability:\n\nWebmin before 1.930 allows remote exploits if the option to change expired\npasswords is enabled (CVE-2019-15107).\n\nNote that it is only vulnerable if changing of expired passwords is enabled,\nwhich is not the case by default.\n","status":"published","published":"2019-08-31T13:22:36Z","modified":"2026-04-16T04:41:40.108313913Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}