CVE-2002-0757

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

(1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://online.securityfocus.com/archive/1/271466Exploit, Patch, Vendor Advisory
http://www.iss.net/security_center/static/9037.phpPatch, Vendor Advisory
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-033.phpPatch
http://www.securityfocus.com/bid/4700Patch, Vendor Advisory
http://online.securityfocus.com/archive/1/271466Exploit, Patch, Vendor Advisory
http://www.iss.net/security_center/static/9037.phpPatch, Vendor Advisory
http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-033.phpPatch
http://www.securityfocus.com/bid/4700Patch, Vendor Advisory

Timeline

Published: Aug 12, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-07587.5ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, whi CVE-2002-07595.0bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the O_EXCL flag t CVE-2002-07601.2Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, decompresses CVE-2002-07612.1bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead CVE-2002-07627.2shadow package in SuSE 8.0 allows local users to destroy the /etc/passwd and /etc/shadow files or assign extra group privileges to some user CVE-2002-07637.5Vulnerability in administration server for HP VirtualVault 4.5 on HP-UX 11.04 allows remote web servers or privileged external processes to CVE-2002-07647.5Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php tha CVE-2002-07657.5sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in wi CVE-2002-07667.2OpenBSD 2.9 through 3.1 allows local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel CVE-2002-07677.2simpleinit on Linux systems does not close a read/write FIFO file descriptor before creating a child process, which allows the child process CVE-2002-07687.5Buffer overflow in lukemftp FTP client in SuSE 6.4 through 8.0, and possibly other operating systems, allows a malicious FTP server to execu CVE-2002-07696.4The web-based configuration interface for the Cisco ATA 186 Analog Telephone Adaptor allows remote attackers to bypass authentication via an