1. CVE-Search
  2. CVE-2005-3042
ID CVE-2005-3042
Summary miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return).
References
Vulnerable Configurations
  • cpe:2.3:a:usermin:usermin:1.150:*:*:*:*:*:*:*
    cpe:2.3:a:usermin:usermin:1.150:*:*:*:*:*:*:*
  • cpe:2.3:a:webmin:webmin:1.2.20:*:*:*:*:*:*:*
    cpe:2.3:a:webmin:webmin:1.2.20:*:*:*:*:*:*:*
CVSS
Base: 7.5 (as of 08-03-2011 - 02:25)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:P/A:P
refmap via4
bid 14889
bugtraq 20050921 [SNS Advisory No.83] Webmin/Usermin PAM Authentication Bypass Vulnerability
confirm
gentoo GLSA-200509-17
jvn JVN#40940493
mandriva MDKSA-2005:176
misc http://www.lac.co.jp/business/sns/intelligence/SNSadvisory_e/83_e.html
osvdb 19575
secunia
  • 16858
  • 17282
sreason 17
suse SUSE-SR:2005:024
vupen ADV-2005-1791
Last major update 08-03-2011 - 02:25
Published 22-09-2005 - 10:03
Last modified 08-03-2011 - 02:25
Back to Top