5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.956 High
EPSS
Percentile
99.4%
Webmin is a web-based interface for Unix-like systems. Usermin is a simplified version of Webmin designed for use by normal users rather than system administrators.
A vulnerability in both Webmin and Usermin has been discovered by Kenny Chen, wherein simplify_path is called before the HTML is decoded.
A non-authenticated user can read any file on the server using a specially crafted URL.
For a temporary workaround, IP Access Control can be setup on Webmin and Usermin.
All Webmin users should update to the latest stable version:
# emerge --sync
# emerge --ask --verbose --oneshot ">=app-admin/webmin-1.290"
All Usermin users should update to the latest stable version:
# emerge --sync
# emerge --ask --verbose --oneshot ">=app-admin/usermin-1.220"
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Gentoo | any | all | app-admin/webmin | < 1.290 | UNKNOWN |
Gentoo | any | all | app-admin/usermin | < 1.220 | UNKNOWN |