CVE-2018-8712

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2018-8712
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-8712.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-8712
Published
2018-03-14T19:29:00.830Z
Modified
2026-04-10T04:12:54.809116Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/save_log.cgi?view=1&file=/etc/shadow" request.

References

Affected packages

Git / github.com/webmin/webmin

Affected ranges

Type
GIT
Repo
https://github.com/webmin/webmin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
867fda60dc99af153822fcdd9caa5c18d63bcc6a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8dd9b5eedc170ebc3cb4d2301a7f9a7fa9d42a03
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.840"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.880"
        }
    ]
}

Affected versions

1.*
1.700
1.710
1.720
1.730
1.740
1.750
1.760
1.770
1.780
1.790
1.800
1.801
1.810
1.820
1.830
1.831
1.840
1.850
1.860
1.870
1.880

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-8712.json"