Vulnerability Details : CVE-2006-3392

Public exploit exists!
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274.
Published 2006-07-06 20:05:00
Updated 2025-04-03 01:03:51
Source MITRE
View at NVD,   CVE.org

Products affected by CVE-2006-3392

Exploit prediction scoring system (EPSS) score for CVE-2006-3392

EPSS FAQ
71.90%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2006-3392

  • Webmin File Disclosure
    Disclosure Date: 2006-06-30
    First seen: 2020-04-26
    auxiliary/admin/webmin/file_disclosure
    A vulnerability has been reported in Webmin and Usermin, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to an unspecified error within the handling of an URL. This can be exploited to read the

CVSS scores for CVE-2006-3392

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.0
 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N
10.0
2.9
 NIST

References for CVE-2006-3392

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close