CVE-2002-2360: Critical severity webmin webmin vulnerability
The RPC module in Webmin 0.21 through 0.99, when installed without root or admin privileges, allows remote attackers to read and write to arbitrary files and execute arbitrary commands via remoteforeignrequire and remoteforeigncall requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block or filter RPC requests named remote_foreign_require and remote_foreign_call to the Webmin RPC module at the network perimeter (firewall, WAF, or ACLs) to prevent remote invocation of these methods.
- Operational
Inventory your environment for Webmin installations running versions 0.21 through 0.99 and identify which of those installations were installed without root or admin privileges. Isolate or block network access to any identified vulnerable hosts until remediated.
- Operational
For any Webmin instances that were installed without root or admin privileges, reinstall or reconfigure so Webmin (and its RPC module) is installed with root or admin privileges.
Event History
Frequently Asked Questions
What is the severity of CVE-2002-2360?
CVE-2002-2360 is classified as a high severity vulnerability due to its potential for unauthorized file access and command execution.
How do I fix CVE-2002-2360?
To fix CVE-2002-2360, ensure that Webmin is installed with proper root or admin privileges and update to the latest version to mitigate the vulnerability.
What versions are affected by CVE-2002-2360?
CVE-2002-2360 affects Webmin versions from 0.21 to 0.99, specifically those with improper RPC module configurations.
What are the consequences of CVE-2002-2360?
The consequences of CVE-2002-2360 include the ability for remote attackers to read and write arbitrary files and execute commands on the server.
How can I check if my Webmin installation is vulnerable to CVE-2002-2360?
You can check for CVE-2002-2360 vulnerability by reviewing your Webmin version and ensuring it is not within the affected range of 0.21 to 0.99 without appropriate configurations.