Cloudanix VulnDB

CVE-2006-3392

None

CVSS

—

EPSS

78.3%

Published

Jul 6, 2006

CISA due date

—

The record

Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.

Affected packages

Ecosystem Package Introduced Fixed
Debian:3.1 webmin 0 1.180-3sarge1

Related vulnerabilities