{"uuid": "5eb78dd4-8bce-47b3-8889-d96d750f25c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36446", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/webmin_package_updates_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64, aarch64\", \"author\": [\"Christophe De La Fuente\", \"Emir Polat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an arbitrary command injection in Webmin\\n          versions prior to 1.997.\\n\\n          Webmin uses the OS package manager (`apt`, `yum`, etc.) to perform\\n          package updates and installation. Due to a lack of input\\n          sanitization, it is possibe to inject arbitrary command that will be\\n          concatenated to the package manager call.\\n\\n          This exploit requires authentication and the account must have access\\n          to the Software Package Updates module.\", \"disclosure_date\": \"2022-07-26\", \"fullname\": \"exploit/linux/http/webmin_package_updates_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:55:15 +0000\", \"name\": \"Webmin Package Updates RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/webmin_package_updates_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/webmin_package_updates_rce\", \"references\": [\"EDB-50998\", \"URL-https://medium.com/@emirpolat/cve-2022-36446-webmin-1-997-7a9225af3165\", \"CVE-2022-36446\"], \"rport\": 10000, \"session_types\": false, \"targets\": [\"Unix In-Memory\", \"Linux Dropper (x86 & x64)\", \"Linux Dropper (ARM64)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:03.083270Z"}