NA

CVE-2022-35132

Published: 25/10/2022 Updated: 26/10/2022
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 0

Vulnerability Summary

Usermin up to and including 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

webmin usermin

Github Repositories

Vulnerabilities for webmin 1.995 and usermin 1.850

Usermin Vulnerabilities for usermin 1850 and prior Code Execution 1 - CVE-2022-35132 Type: Authenticated code execution A authenticated user can execute commands using the GPG module This is useful if the shell module has been restricted for that user Vulnerability: importcgi line 24 executes unsanitized user input $out = `$gpgpath --import '$in{'file'}