CVE-2019-15107 Webmin Command Injection

Q: Is CVE-2019-15107 being exploited?

Yes. Attackers have exploited CVE-2019-15107 in the wild since at least 25 Mar 2022, including in ransomware campaigns.

Q: How do I fix CVE-2019-15107?

Upgrade to a fixed version. US federal agencies must fix it by 15 Apr 2022.

Exploited in the wild Critical 9.8 Published 16 Aug 2019 Updated 6 Aug 2026

Attackers can execute arbitrary commands via the password change interface, requiring immediate upgrade of Webmin.

Exploited in the wild: Since 25 Mar 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-15107?

CVE-2019-15107 is a critical command injection vulnerability in Webmin Webmin, published on 16 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.

Weakness: CWE-78

Which versions are affected by CVE-2019-15107?

It affects 1 product.

Products include Webmin Webmin.

How do I fix CVE-2019-15107?

Upgrade to a fixed version. US federal agencies must fix it by 15 Apr 2022.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2019-15107 being exploited?

Yes. Attackers have exploited CVE-2019-15107 in the wild since at least 25 Mar 2022, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 2 Exploit-DB entries, 1 Nuclei template and 42 proofs of concept on GitHub.

All Webmin Webmin vulnerabilities

Sources

Also known as CVE-2019-15231, GHSA-69hp-hrv4-rxrr, MGASA-2019-0237.