Description
miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | webmin | 0.94-7woody1 | DSA-319 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Webmin 0.9x / Usermin 0.9x/1.0 - Access Session ID Spoofing EDB-22275 · remote · Feb 20, 2003 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- DSA-319 webmin - session ID spoofing Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-319 vendor-advisory
- http://www.linuxsecurity.com/advisories/gentoo_advisory-2886.html
- 20030224 GLSA: usermin (200302-14) mailing-list
- N-058 third-party-advisory government-resource
- 8163 third-party-advisory
- MDKSA-2003:025 vendor-advisory
- HPSBUX0303-250 vendor-advisory
- 8115 third-party-advisory
- 1006160 vdb-entry
- 20030224 [SNS Advisory No.62] Webmin/Usermin Session ID Spoofing Vulnerability "Episode 2" mailing-list
- ESA-20030225-006 vendor-advisory
- http://marc.info/?l=webmin-announce&m=104587858408101&w=2
- 20030224 Webmin 1.050 - 1.060 remote exploit mailing-list
- http://www.lac.co.jp/security/english/snsadv_e/62_e.html
- webmin-usermin-root-access(11390) vdb-entry
- 6915 vdb-entry