Threats tagged 'ghsa-wc4p-j42q-3r22'

Webmin versions up to 2.670 contain an OS command injection vulnerability in the samba/save_euser.cgi script. This flaw allows authenticated Samba user maintainers to inject arbitrary commands via the unvalidated opts parameter. Exploitation involves embedding shell metacharacters in account option flags used by create_user and modify_user functions, resulting in command execution with root privileges.