Vulnerability in Webmin
CVE-2001-1074
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.
EPSS: 0.005 (40.8th percentile) — read the EPSS interpretation.
Affected products
- Webmin — versions 0.5, 0.6, 0.7
- N/a — versions n/a
References
- cve@mitre.org (Exploit, Patch, vdb-entry, x_refsource_BID, Vendor Advisory)
- cve@mitre.org (Vendor Advisory, mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (Vendor Advisory, x_refsource_CALDERA, vendor-advisory, Patch)
- cve@mitre.org (vendor-advisory, Patch, x_refsource_MANDRAKE)