TI-2024-24230 Aliases CVE-2024-36451 GHSA-4cjw-fj8x-xj3r

Improper handling of insufficient permissions or privileges vulnerability exists in…

MEDIUM 41CWE-280Published 2024-07-10 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to 2.003. If this vulnerability is exploited, a console session may be hijacked by an unauthorized user. As a result, data within a system may be referred, a webpage may be altered, or a server may be permanently halted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00569 47th percentileScored 2026-11-07

Fix Fixed Webmin (Webmin): 2.003

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Webmin	Webmin	before 2.003	2.003	Patch available	CNA

Webmin VendorWebmin Affected before 2.003 Fixed in 2.003 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:webmin:webmin::::::::	before 2.003	Vulnerable	Webmin

cpe:2.3:a:webmin:webmin:*:*:*:*:*:*:*:* Versions before 2.003 Vulnerable ·Webmin

Remediation

Fix · CNA Webmin (Webmin) Fixed in 2.003

Timeline

2026-10-02 Threatist record created from CVE-2024-36451
2026-10-03 Alias added: GHSA-4cjw-fj8x-xj3r

References

Advisory 1

https://jvn.jp/en/jp/JVN81442045/

Other 1

https://webmin.com/

TI-2019-11278 An issue was discovered in Webmin <=1.920. KEVCVSS 3.1CRITICAL 9.8
TI-2022-16770 software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. CVSS 3.1CRITICAL 9.8
TI-2022-00731 Improper Access Control to Remote Code Execution in webmin/webmin CVSS 3.1HIGH 8.8
TI-2019-09619 In Webmin through 1.910, any user authorized to the "Package Updates" module can execute… CVSS 3.0HIGH 8.8
TI-2021-11777 Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote… CVSS 3.1CRITICAL 9.6
TI-2024-11888 OS command injection in Webmin CVSS 3.1HIGH 8.8

See all 95 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences