NVD

Id
62070  
Name
CVE-2006-3392  
Description
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2016-12-20  
Published
2006-07-06  
Modified Date
2011-03-07  
Seq
2006-3392  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
321347 62070 CVE-2006-3392 20060711 Re: Webmin traversal - changelog  View
321348 62070 CVE-2006-3392 20060630 Webmin traversal - changelog  View
321349 62070 CVE-2006-3392 GLSA-200608-11  View
321350 62070 CVE-2006-3392 DSA-1199  View
321351 62070 CVE-2006-3392 VU#999601  View
321352 62070 CVE-2006-3392 MDKSA-2006:125  View
321353 62070 CVE-2006-3392 20060715 Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit  View
321354 62070 CVE-2006-3392 20060709 Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit  View
321355 62070 CVE-2006-3392 20060710 Re: Webmin / Usermin Arbitrary File Disclosure Vulnerability exploit  View
321356 62070 CVE-2006-3392 20060715 Webmin / Usermin Arbitrary File Disclosure Vulnerability Perl  View
321357 62070 CVE-2006-3392 18744  View
321358 62070 CVE-2006-3392 ADV-2006-2612  View
321359 62070 CVE-2006-3392 http://www.webmin.com/changes.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
58683 JVNDB-2006-000948 Webmin および Usermin の simplify_path() 関数における任意のファイルを読み込みが可能な脆弱性 Webmin および Usermin には、simplify_path() 関数の URL 処理に不備が存在するため、特定の URL を利用することで、リモートから任意のファイルが読み取られる脆弱性が存在します。 CVE-2006-3392 19494 CVE-2006-3392 62070 5 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-000948.html 2006-06-30 2007-05-16 View