Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands…
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an external IMAP client, then delete it in Usermin to run commands as their system account, bypassing webmail-only restrictions.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Webmin
- Product
- usermin
- CVSS v3.1
- 7.5 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-78
- NVD status
- Received
Why it ranks 12 (Routine)
- CVSS v3.1 7.5 high
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.