CVE-2012-2982 describes a remote command execution vulnerability in Webmin versions 1.590 and earlier, specifically affecting the file/show.cgi component. This flaw allows authenticated attackers to execute arbitrary commands by injecting special characters, such as a pipe symbol, into a pathname. The vulnerability carries a CVSS score of 6.5, indicating a medium severity. It is easily exploitable over the network with low attack complexity, requiring only authenticated access, and can lead to partial compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, exploit code is publicly available, including a Metasploit module, suggesting potential for exploitation. Despite this, there is no recorded community discussion or media coverage, indicating a lack of widespread public attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.590CPE matchmatch criteria | cpe:2.3:a:gentoo:webmin:*:*:*:*:*:*:*:* | ||
1.140CPE matchmatch criteria | cpe:2.3:a:gentoo:webmin:1.140:*:*:*:*:*:*:* | ||
1.150CPE matchmatch criteria | cpe:2.3:a:gentoo:webmin:1.150:*:*:*:*:*:*:* | ||
1.160CPE matchmatch criteria | cpe:2.3:a:gentoo:webmin:1.160:*:*:*:*:*:*:* | ||
1.170CPE matchmatch criteria | cpe:2.3:a:gentoo:webmin:1.170:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:S/C:P/I:P/A:P
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.