Back to search
CVE-2006-3392
Published: Jul 6, 2006
Modified: Aug 7, 2024
PUBLISHED
Description
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
21365
third-party-advisory
x_refsource_SECUNIA
GLSA-200608-11
vendor-advisory
x_refsource_GENTOO
http://www.webmin.com/changes.html
x_refsource_CONFIRM
20060710 Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit
mailing-list
x_refsource_BUGTRAQ
21105
third-party-advisory
x_refsource_SECUNIA
18744
vdb-entry
x_refsource_BID
20060715 Webmin / Usermin Arbitrary File Disclosure Vulnerability Perl
mailing-list
x_refsource_BUGTRAQ
20060715 Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit
mailing-list
x_refsource_BUGTRAQ
VU#999601
third-party-advisory
x_refsource_CERT-VN
DSA-1199
vendor-advisory
x_refsource_DEBIAN
20060630 Webmin traversal - changelog
mailing-list
x_refsource_VIM
20892
third-party-advisory
x_refsource_SECUNIA
MDKSA-2006:125
vendor-advisory
x_refsource_MANDRIVA
ADV-2006-2612
vdb-entry
x_refsource_VUPEN
20060709 Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit
mailing-list
x_refsource_BUGTRAQ
26772
vdb-entry
x_refsource_OSVDB
22556
third-party-advisory
x_refsource_SECUNIA
20060711 Re: Webmin traversal - changelog
mailing-list
x_refsource_VIM
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now