Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
'CVE-2006-3392 is a classic directory traversal vulnerability in Webmin' https://t.co/84MOQmsRNf
Post summary
The tweet only identifies CVE-2006-3392 as a directory traversal flaw in Webmin, without mentioning PoC, exploit, patch, or active exploitation.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | usermin | usermin | - | - | - |
| App | webmin | webmin | - | - | - |