The remote host is affected by the vulnerability described in GLSA-200406-12 (Webmin: Multiple vulnerabilities)

    Webmin contains two security vulnerabilities. One allows any user to     view the configuration of any module and the other could allow an     attacker to lock out a valid user by sending an invalid username and     password.
  Impact :

    An authenticated user could use these vulnerabilities to view the     configuration of any module thus potentially obtaining important     knowledge about configuration settings. Furthermore, an attacker could     lock out legitimate users by sending invalid login information.
  Workaround :

    There is no known workaround at this time.

自己報告されたバージョンによると、リモートホストでホストされているWebminインストールは1.140です。したがって、複数の脆弱性による影響を受けます。

The remote host is affected by the vulnerability described in GLSA-200406-15 (Usermin: Multiple vulnerabilities)

    Usermin contains two security vulnerabilities. One fails to properly     sanitize email messages that contain malicious HTML or script code and     the other could allow an attacker to lock out a valid user by sending     an invalid username and password.
  Impact :

    By sending a specially crafted e-mail, an attacker can execute     arbitrary scripts running in the context of the victim's browser. This     can be lead to cookie theft and potentially to compromise of user     accounts. Furthermore, an attacker could lock out legitimate users by     sending invalid login information.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version.

根據其自我報告的版本，遠端主機上安裝的 Webmin 是 1.140 版。因此，會受到多個弱點影響。

根据其自我报告的版本，远程主机上托管的 Webmin 安装版本为 1.140。因而会受到多个漏洞的影响。

According to its self-reported version, the Webmin install hosted on the remote host is 1.140. It is, therefore, affected by multiple vulnerabilities.

Two vulnerabilities were discovered in webmin :

 CAN-2004-0582: Unknown vulnerability in Webmin 1.140 allows remote  attackers to bypass access control rules and gain read access to  configuration information for a module.

 CAN-2004-0583: The account lockout functionality in (1) Webmin 1.140  and (2) Usermin 1.070 does not parse certain character strings, which  allows remote attackers to conduct a brute-force attack to guess user  IDs and passwords.

Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module. (CVE-2004-0582)

The account lockout functionality in Webmin 1.140 does not parse certain character strings, which allows remote attackers to conduct a brute-force attack to guess user IDs and passwords. (CVE-2004-0583)

The updated packages are patched to correct the problem.

ID	名稱	產品	系列	已發布	已更新	嚴重性
14523	GLSA-200406-12 : Webmin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2004/8/30	2021/1/6	medium
108545	Webmin 1.140の複数の脆弱性	Nessus	CGI abuses	2018/3/22	2019/11/8	medium
14526	GLSA-200406-15 : Usermin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2004/8/30	2021/1/6	medium
108545	Webmin 1.140 多個弱點	Nessus	CGI abuses	2018/3/22	2019/11/8	medium
108545	Webmin 1.140 多个漏洞	Nessus	CGI abuses	2018/3/22	2019/11/8	medium
108545	Webmin 1.140 Multiple Vulnerabilities	Nessus	CGI abuses	2018/3/22	2019/11/8	medium
15363	Debian DSA-526-1 : webmin - several vulnerabilities	Nessus	Debian Local Security Checks	2004/9/29	2021/1/4	medium
14172	Mandrake Linux Security Advisory : webmin (MDKSA-2004:074)	Nessus	Mandriva Local Security Checks	2004/7/31	2021/1/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium