Unscored severity · published May 28, 2001
CVE-2001-1074
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to…
–
CVSS
0.5%
EPSS
No
On KEV
Description
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
Webmin · Webmin
0.5; 0.6; 0.7; 0.80; 0.83; 0.84 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-1074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-1074
Vendor Advisory
http://archives.neohapsis.com/archives/bugtraq/2001-05/0262.html
Patch
http://www.calderasystems.com/support/security/advisories/CSSA-2001-019.1.txt
Patch
http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-059.php3
Exploit
http://www.securityfocus.com/bid/2795
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/6627
More from Webmin
9.8
CVE-2019-15107
Webmin Command Injection Vulnerability
9.8
CVE-2022-36446
software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command
9.8
CVE-2020-35769
miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program
9.8
CVE-2018-8712
An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled
9.6
CVE-2026-49243
Webmin: Reflected XSS in the Configuration module