Unscored severity · published Aug 12, 2002
CVE-2002-0757
(1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control…
–
CVSS
1.9%
EPSS
No
On KEV
Description
(1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
US
Usermin · Usermin
0.7; 0.8; 0.9 · source: NVD
WE
Webmin · Webmin
0.91; 0.92; 0.92.1; 0.93; 0.94; 0.95; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2002-0757
CVE.org
https://www.cve.org/CVERecord?id=CVE-2002-0757
Exploit
http://online.securityfocus.com/archive/1/271466
Patch
http://www.iss.net/security_center/static/9037.php
Patch
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-033.php
Patch
http://www.securityfocus.com/bid/4700
More from Usermin
–
CVE-2007-1276
Multiple cross-site scripting (XSS) vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML…
–
CVE-2006-4246
Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in…
–
CVE-2006-4542
Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read…
–
CVE-2006-3392
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using…
–
CVE-2005-3042
miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via…