CVE-2004-0583 The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs an...
MediumCVSS 5.0
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| usermin | = 1.070 | No fix listed |
| webmin | = 1.1.40 | No fix listed |
| debian linux | = 3.0 | No fix listed |
References
- 20040611 [SNS Advisory No.75] Webmin/Usermin Account Lockout Bypass Vulnerability mailing-list
- DSA-526 vendor-advisory
- GLSA-200406-12 vendor-advisory
- GLSA-200406-15 vendor-advisory
- www.lac.co.jp
- MDKSA-2004:074 vendor-advisory
- 10474 patch vdb-entry vendor-advisory
- 10523 patch vdb-entry vendor-advisory
- www.webmin.com
- webmin-username-password-dos(16334) vdb-entry