CVE-2017-15644 Server-side request forgery in n/a

What is CVE-2017-15644?

CVE-2017-15644 is a high-severity server-side request forgery vulnerability in Webmin Webmin, published on 19 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000.

Weakness: CWE-918

Which versions are affected by CVE-2017-15644?

It affects 1 product.

Products include Webmin Webmin.

How do I fix CVE-2017-15644?

No fix has been published for CVE-2017-15644 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2017-15644 being exploited?

There is no known exploitation of CVE-2017-15644 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Webmin Webmin

• CVE-2019-15107 Webmin Command Injection Exploited Critical 9.8
• CVE-2002-2201 Command injection in n/a Critical 10.0
• CVE-2001-1196 Path traversal in n/a Critical 10.0
• CVE-2024-12828 Webmin CGI Command Injection Remote Code Execution Vulnerability Critical 9.9
• CVE-2022-36446 Cross-site scripting in n/a Critical 9.8

All Webmin Webmin vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wggh-6887-64v4.