CVE-2018-8712: Path Traversal
An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/savelog.cgi?view=1&file=/etc/shadow" request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In Webmin versions 1.840 and 1.880, disable the weak default setting “Can view any file as a log file” (i.e., change the default Yes to No) to prevent limited users from reading underlying Unix system files such as /etc/shadow via requests like GET /syslog/save_log.cgi?view=1&file=/etc/shadow.
Webmin Can view any file as a log file = Disable (set to No)
Event History
Frequently Asked Questions
What is CVE-2018-8712?
CVE-2018-8712 is a vulnerability in Webmin versions 1.840 and 1.880 that allows limited users to have full access to underlying Unix system files.
How severe is CVE-2018-8712?
CVE-2018-8712 has a severity rating of 9.8, which is classified as critical.
Which software versions are affected by CVE-2018-8712?
Webmin versions 1.840 and 1.880 are affected by CVE-2018-8712.
What is the Common Weakness Enumeration (CWE) for CVE-2018-8712?
The Common Weakness Enumeration (CWE) for CVE-2018-8712 is CWE-22.
Is there a fix available for CVE-2018-8712?
Yes, it is recommended to update to a fixed version of Webmin to address the vulnerability.