Read the docs
TI-2012-04135 Aliases CVE-2012-4893GHSA-hh2h-5vcr-gr3x

Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin…

Priority LOW 32CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Tampering
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that (1) read files or execute (2) tar, (3) zip, or (4) gzip commands, a different issue than CVE-2012-2982.

Why it matters now

EPSS 0.00847 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:gentoo:webmin:*:*:*:*:*:*:*:*up to 1.590Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.140:*:*:*:*:*:*:*1.140Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.150:*:*:*:*:*:*:*1.150Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.160:*:*:*:*:*:*:*1.160Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.170:*:*:*:*:*:*:*1.170Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.180:*:*:*:*:*:*:*1.180Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.200:*:*:*:*:*:*:*1.200Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.210:*:*:*:*:*:*:*1.210Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.220:*:*:*:*:*:*:*1.220Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.230:*:*:*:*:*:*:*1.230Vulnerablegentoo
  • cpe:2.3:a:gentoo:webmin:*:*:*:*:*:*:*:* Versions up to 1.590 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.140:*:*:*:*:*:*:* Versions 1.140 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.150:*:*:*:*:*:*:* Versions 1.150 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.160:*:*:*:*:*:*:* Versions 1.160 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.170:*:*:*:*:*:*:* Versions 1.170 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.180:*:*:*:*:*:*:* Versions 1.180 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.200:*:*:*:*:*:*:* Versions 1.200 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.210:*:*:*:*:*:*:* Versions 1.210 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.220:*:*:*:*:*:*:* Versions 1.220 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.230:*:*:*:*:*:*:* Versions 1.230 Vulnerable ·gentoo
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gentoo:webmin:1.240:*:*:*:*:*:*:*1.240Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.260:*:*:*:*:*:*:*1.260Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.270:*:*:*:*:*:*:*1.270Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.280:*:*:*:*:*:*:*1.280Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.290:*:*:*:*:*:*:*1.290Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.300:*:*:*:*:*:*:*1.300Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.310:*:*:*:*:*:*:*1.310Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.320:*:*:*:*:*:*:*1.320Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.330:*:*:*:*:*:*:*1.330Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.340:*:*:*:*:*:*:*1.340Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.370:*:*:*:*:*:*:*1.370Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.380:*:*:*:*:*:*:*1.380Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.390:*:*:*:*:*:*:*1.390Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.400:*:*:*:*:*:*:*1.400Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.410:*:*:*:*:*:*:*1.410Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.420:*:*:*:*:*:*:*1.420Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.430:*:*:*:*:*:*:*1.430Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.440:*:*:*:*:*:*:*1.440Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.450:*:*:*:*:*:*:*1.450Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.470:*:*:*:*:*:*:*1.470Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.480:*:*:*:*:*:*:*1.480Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.500:*:*:*:*:*:*:*1.500Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.510:*:*:*:*:*:*:*1.510Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.520:*:*:*:*:*:*:*1.520Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.530:*:*:*:*:*:*:*1.530Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.550:*:*:*:*:*:*:*1.550Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.560:*:*:*:*:*:*:*1.560Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.570:*:*:*:*:*:*:*1.570Vulnerablegentoo
cpe:2.3:a:gentoo:webmin:1.580:*:*:*:*:*:*:*1.580Vulnerablegentoo
  • cpe:2.3:a:gentoo:webmin:1.240:*:*:*:*:*:*:* Versions 1.240 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.260:*:*:*:*:*:*:* Versions 1.260 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.270:*:*:*:*:*:*:* Versions 1.270 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.280:*:*:*:*:*:*:* Versions 1.280 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.290:*:*:*:*:*:*:* Versions 1.290 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.300:*:*:*:*:*:*:* Versions 1.300 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.310:*:*:*:*:*:*:* Versions 1.310 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.320:*:*:*:*:*:*:* Versions 1.320 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.330:*:*:*:*:*:*:* Versions 1.330 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.340:*:*:*:*:*:*:* Versions 1.340 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.370:*:*:*:*:*:*:* Versions 1.370 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.380:*:*:*:*:*:*:* Versions 1.380 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.390:*:*:*:*:*:*:* Versions 1.390 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.400:*:*:*:*:*:*:* Versions 1.400 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.410:*:*:*:*:*:*:* Versions 1.410 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.420:*:*:*:*:*:*:* Versions 1.420 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.430:*:*:*:*:*:*:* Versions 1.430 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.440:*:*:*:*:*:*:* Versions 1.440 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.450:*:*:*:*:*:*:* Versions 1.450 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.470:*:*:*:*:*:*:* Versions 1.470 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.480:*:*:*:*:*:*:* Versions 1.480 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.500:*:*:*:*:*:*:* Versions 1.500 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.510:*:*:*:*:*:*:* Versions 1.510 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.520:*:*:*:*:*:*:* Versions 1.520 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.530:*:*:*:*:*:*:* Versions 1.530 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.550:*:*:*:*:*:*:* Versions 1.550 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.560:*:*:*:*:*:*:* Versions 1.560 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.570:*:*:*:*:*:*:* Versions 1.570 Vulnerable ·gentoo
  • cpe:2.3:a:gentoo:webmin:1.580:*:*:*:*:*:*:* Versions 1.580 Vulnerable ·gentoo

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-4893
  2. 2026-10-03 Alias added: GHSA-hh2h-5vcr-gr3x

References

Advisory 1

Other 2

  • TI-2012-02589 file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute… CVSS 2.0MEDIUM 6.5
  • TI-2012-02590 file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check… CVSS 2.0MEDIUM 5.0
  • TI-2012-02588 Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code… CVSS 2.0MEDIUM 6.0
  • TI-2005-00385 The ebuild of Webmin before 1.170-r3 on Gentoo Linux includes the encrypted root password… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences