CVE-2006-3392 in Webmin
要約 (英語)
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
予約する
2006年07月06日
公開
2006年07月06日
ステータス
確認済み
エントリ
VulDB provides additional information and datapoints for this CVE:
| 識別子 | 脆弱性 | CWE | 悪用可 | 対策 | CVE |
|---|---|---|---|---|---|
| 2350 | Jamie Cameron Webmin 弱い認証 | 287 | 高い | 公式な修正 | CVE-2006-3392 |