PT-2002-2397 · Webmin · Webmin

Published 2002-12-31 · Updated 2017-07-11 · CVE-2002-1673

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Webmin version 0.92

Description The issue concerns the web interface of the affected software, which fails to properly quote or filter script code in displayed files. This allows local users to execute script code and potentially steal cookies by inserting the script into specific files or fields, such as a real user name entry in the passwd file.

Recommendations For Webmin version 0.92, consider restricting access to the web interface until a proper fix is applied, and avoid inserting untrusted data into files or fields that are displayed by the web interface. As a temporary workaround, consider disabling the display of files that may contain script code in the web interface to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-1673

Affected Products

Webmin

References · 5

• 🔥 https://exploit-db.com/exploits/21348 · Exploit
• 🔥 http://securityfocus.com/bid/4329 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1673 · Security Note
• http://online.securityfocus.com/archive/1/263181 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/8596 · Note