CVE-2006-3392

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as…

published July 6, 2006

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.6th percentile for exploit probability.

CVSS
—
EPSS
79%
Percentile
99.6
In the wild
Unconfirmed
What it is

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.79489 · 99.6th percentile
Published
2006-07-06T20:00Z
EPSS history
Timeline
  • 06 JUL 20:00Z
    Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as…
    cvelistv5