CVE-2019-15107 is a command injection vulnerability in Webmin Webmin. CISA added it to the Known Exploited Vulnerabilities catalogue on 25 March 2022, which means attackers have used it in real attacks. An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
Why this Webmin flaw matters
Command injection turns a web-facing feature into an execution path on the underlying host. In Webmin, that is especially dangerous because administrative interfaces often run with elevated system privileges, so a single crafted request can move from application input to operating-system command execution.
That makes the flaw more than a routine input-validation bug. A successful exploit can let an attacker alter configuration, add new accounts, drop binaries, or pivot into the rest of the server estate through the compromised management plane.
How exploitation typically works
The vulnerable old parameter in password_change.cgi is dangerous because it sits in a context where user-supplied data is handled by the server and then reaches command execution logic. Command injection usually succeeds when input is concatenated into shell commands instead of being validated, parameterised, or safely escaped.
For defenders, the important point is that the exploit path is not limited to password changes. Any exposed administrative function that accepts structured input can become a remote code execution path if it passes data into the shell. The general pattern is covered in Web Application Attacks Guide, which includes command injection and adjacent injection classes.
Exposure, impact, and identity consequences
Organisations should first confirm whether any Webmin instance is reachable from the internet, whether it is still supported in inventory, and whether it is used for privileged administration on production hosts. Public exposure and administrative privilege make this kind of flaw much more urgent than a bug in a low-impact application.
If exploitation succeeds, the impact is usually broader than the initial command. An attacker can steal or mint credentials, modify service configurations, plant persistence, or use the server as a stepping stone into adjacent systems. When the compromised system hosts secrets or automation credentials, those materials should be treated as exposed until reviewed and rotated.
For authoritative vulnerability and record details, consult the CVE Program and the NIST National Vulnerability Database rather than relying on secondary write-ups.
Remediation and verification
Fixing this issue starts with removing the vulnerable exposure, then verifying that no attacker-controlled commands were already executed. If a patch cannot be applied immediately, reduce exposure by restricting network access to the management interface, placing it behind strong administrative controls, and disabling unnecessary remote reachability.
After remediation, review logs, shell history, scheduled tasks, web server logs, and nearby authentication events for signs of post-exploit activity. Because command injection often leads to host-level compromise rather than a single application crash, recovery should include a compromise assessment, not just a version change.
For broader prioritisation and remediation workflow, Vulnerability Management Guide covers asset scope, KEV prioritisation, verification, and remediation tracking. Where the issue sits in a larger web-attack pattern, the OWASP Top 10 remains the standard high-level reference for injection and input-handling risk.
Risk and Threat Considerations
Internet-exposed administrative software is a high-value target because it can collapse the distance between a web request and host compromise. When command injection is present, the main risk is that an apparently small input flaw becomes full server control, with follow-on access to credentials, configurations, and lateral movement paths.
Failure mechanism: Unsanitised input is passed into shell execution, allowing attacker-controlled metacharacters or command fragments to run on the host.
Impact: The attacker may gain code execution, persistence, secret access, or a foothold for broader intrusion across the environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP ASVS, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V15 — Secure Coding and Architecture | Command injection is a secure-coding and input-handling failure in a web admin surface. |
| V16 — Security Logging and Error Handling | Post-exploit review depends on logs and error handling around the vulnerable request path. | |
| Recommendation — Validate and refactor command construction so untrusted input never reaches shell execution. Review and retain security logs around the affected endpoint to detect exploitation and follow-on activity. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE belongs in active vulnerability prioritisation, remediation and verification workflows. |
| Recommendation — Prioritise and remediate the vulnerable Webmin instance using KEV-based vulnerability management. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | The issue is caused by unsafe handling of user-supplied input that reaches command execution. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Exploit confirmation and post-patch review require analysis of logs and audit records. | |
| Recommendation — Enforce strict input validation and safe command handling on the affected request parameters. Correlate audit and web logs to identify exploitation and post-compromise actions. | ||
Practitioner Guidance
What to watch for: Treat any management interface that accepts user input as potentially dangerous if it can invoke system commands, directly or indirectly. Administrative products deserve the same scrutiny as public web applications because compromise of the management plane usually has outsized blast radius.
Practitioner takeaway: Prioritise exposure removal, not just patching, when a KEV-listed command injection affects a privileged admin surface.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org