Read the docs
TI-2012-02590 Aliases CVE-2012-2983GHSA-g7x5-gg6r-rhm7

file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check…

Priority MEDIUM 42CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field.

Why it matters now

EPSS 0.20456 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:gentoo:webmin:*:*:*:*:*:*:*:*up to 1.590Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.140:*:*:*:*:*:*:*1.140Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.150:*:*:*:*:*:*:*1.150Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.160:*:*:*:*:*:*:*1.160Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.170:*:*:*:*:*:*:*1.170Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.180:*:*:*:*:*:*:*1.180Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.200:*:*:*:*:*:*:*1.200Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.210:*:*:*:*:*:*:*1.210Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.220:*:*:*:*:*:*:*1.220Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.230:*:*:*:*:*:*:*1.230Vulnerablegentoo
  • cpe:2.3:a:gentoo:webmin:*:*:*:*:*:*:*:* Versions up to 1.590 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.140:*:*:*:*:*:*:* Versions 1.140 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.150:*:*:*:*:*:*:* Versions 1.150 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.160:*:*:*:*:*:*:* Versions 1.160 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.170:*:*:*:*:*:*:* Versions 1.170 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.180:*:*:*:*:*:*:* Versions 1.180 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.200:*:*:*:*:*:*:* Versions 1.200 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.210:*:*:*:*:*:*:* Versions 1.210 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.220:*:*:*:*:*:*:* Versions 1.220 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.230:*:*:*:*:*:*:* Versions 1.230 Vulnerable ·gentoo
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gentoo:webmin:1.240:*:*:*:*:*:*:*1.240Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.260:*:*:*:*:*:*:*1.260Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.270:*:*:*:*:*:*:*1.270Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.280:*:*:*:*:*:*:*1.280Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.290:*:*:*:*:*:*:*1.290Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.300:*:*:*:*:*:*:*1.300Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.310:*:*:*:*:*:*:*1.310Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.320:*:*:*:*:*:*:*1.320Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.330:*:*:*:*:*:*:*1.330Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.340:*:*:*:*:*:*:*1.340Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.370:*:*:*:*:*:*:*1.370Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.380:*:*:*:*:*:*:*1.380Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.390:*:*:*:*:*:*:*1.390Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.400:*:*:*:*:*:*:*1.400Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.410:*:*:*:*:*:*:*1.410Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.420:*:*:*:*:*:*:*1.420Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.430:*:*:*:*:*:*:*1.430Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.440:*:*:*:*:*:*:*1.440Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.450:*:*:*:*:*:*:*1.450Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.470:*:*:*:*:*:*:*1.470Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.480:*:*:*:*:*:*:*1.480Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.500:*:*:*:*:*:*:*1.500Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.510:*:*:*:*:*:*:*1.510Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.520:*:*:*:*:*:*:*1.520Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.530:*:*:*:*:*:*:*1.530Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.550:*:*:*:*:*:*:*1.550Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.560:*:*:*:*:*:*:*1.560Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.570:*:*:*:*:*:*:*1.570Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.580:*:*:*:*:*:*:*1.580Vulnerablegentoo
  • cpe:2.3:a:gentoo:webmin:1.240:*:*:*:*:*:*:* Versions 1.240 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.260:*:*:*:*:*:*:* Versions 1.260 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.270:*:*:*:*:*:*:* Versions 1.270 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.280:*:*:*:*:*:*:* Versions 1.280 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.290:*:*:*:*:*:*:* Versions 1.290 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.300:*:*:*:*:*:*:* Versions 1.300 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.310:*:*:*:*:*:*:* Versions 1.310 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.320:*:*:*:*:*:*:* Versions 1.320 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.330:*:*:*:*:*:*:* Versions 1.330 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.340:*:*:*:*:*:*:* Versions 1.340 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.370:*:*:*:*:*:*:* Versions 1.370 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.380:*:*:*:*:*:*:* Versions 1.380 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.390:*:*:*:*:*:*:* Versions 1.390 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.400:*:*:*:*:*:*:* Versions 1.400 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.410:*:*:*:*:*:*:* Versions 1.410 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.420:*:*:*:*:*:*:* Versions 1.420 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.430:*:*:*:*:*:*:* Versions 1.430 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.440:*:*:*:*:*:*:* Versions 1.440 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.450:*:*:*:*:*:*:* Versions 1.450 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.470:*:*:*:*:*:*:* Versions 1.470 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.480:*:*:*:*:*:*:* Versions 1.480 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.500:*:*:*:*:*:*:* Versions 1.500 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.510:*:*:*:*:*:*:* Versions 1.510 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.520:*:*:*:*:*:*:* Versions 1.520 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.530:*:*:*:*:*:*:* Versions 1.530 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.550:*:*:*:*:*:*:* Versions 1.550 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.560:*:*:*:*:*:*:* Versions 1.560 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.570:*:*:*:*:*:*:* Versions 1.570 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.580:*:*:*:*:*:*:* Versions 1.580 Vulnerable ·gentoo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-2983
  2. 2026-10-03 Alias added: GHSA-g7x5-gg6r-rhm7

References

Patch 1

Other 4

  • TI-2012-02589 file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute… CVSS 2.0MEDIUM 6.5
  • TI-2012-04135 Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin… CVSS 2.0MEDIUM 6.8
  • TI-2012-02588 Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code… CVSS 2.0MEDIUM 6.0
  • TI-2005-00385 The ebuild of Webmin before 1.170-r3 on Gentoo Linux includes the encrypted root password… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences