CVEvulnerability

CVE-2001-1074

7.2 HIGH Published 2001-05-28 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2001-05-28
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.

Affected configurations

• webmin webmin 0.5 • webmin webmin 0.6 • webmin webmin 0.7 • webmin webmin 0.80 • webmin webmin 0.83 • webmin webmin 0.84

References

http://archives.neohapsis.com/archives/bugtraq/2001-05/0262.html Vendor Advisory
http://www.calderasystems.com/support/security/advisories/CSSA-2001-019.1.txt Patch, Vendor Advisory
http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-059.php3 Patch
http://www.securityfocus.com/bid/2795 Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6627 exchange.xforce.ibmcloud.com
http://archives.neohapsis.com/archives/bugtraq/2001-05/0262.html Vendor Advisory
http://www.calderasystems.com/support/security/advisories/CSSA-2001-019.1.txt Patch, Vendor Advisory
http://www.linux-mandrake.com/en/security/2001/MDKSA-2001-059.php3 Patch
http://www.securityfocus.com/bid/2795 Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/6627 exchange.xforce.ibmcloud.com