Read the docs
TI-2003-00096 Aliases CVE-2003-0101GHSA-hm72-qxg7-34pg

miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly…

Priority MEDIUM 59Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.

Why it matters now

EPSS 0.15469 96th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:engardelinux:guardian_digital_webtool:1.2:*:*:*:*:*:*:*1.2VulnerableEngardelinux
cpe:2.3:a:usermin:usermin:0.4:*:*:*:*:*:*:*0.4VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.5:*:*:*:*:*:*:*0.5VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.6:*:*:*:*:*:*:*0.6VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.7:*:*:*:*:*:*:*0.7VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.8:*:*:*:*:*:*:*0.8VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.9:*:*:*:*:*:*:*0.9VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.91:*:*:*:*:*:*:*0.91VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.92:*:*:*:*:*:*:*0.92VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.93:*:*:*:*:*:*:*0.93VulnerableUsermin
  • cpe:2.3:a:engardelinux:guardian_digital_webtool:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Engardelinux
  • cpe:2.3:a:usermin:usermin:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.91:*:*:*:*:*:*:* Versions 0.91 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.92:*:*:*:*:*:*:* Versions 0.92 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.93:*:*:*:*:*:*:* Versions 0.93 Vulnerable ·Usermin
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:usermin:usermin:0.94:*:*:*:*:*:*:*0.94VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.95:*:*:*:*:*:*:*0.95VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.96:*:*:*:*:*:*:*0.96VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.97:*:*:*:*:*:*:*0.97VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.98:*:*:*:*:*:*:*0.98VulnerableUsermin
cpe:2.3:a:usermin:usermin:0.99:*:*:*:*:*:*:*0.99VulnerableUsermin
cpe:2.3:a:webmin:webmin:1.0.50:*:*:*:*:*:*:*1.0.50VulnerableWebmin
cpe:2.3:a:webmin:webmin:1.0.60:*:*:*:*:*:*:*1.0.60VulnerableWebmin
  • cpe:2.3:a:usermin:usermin:0.94:*:*:*:*:*:*:* Versions 0.94 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.95:*:*:*:*:*:*:* Versions 0.95 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.96:*:*:*:*:*:*:* Versions 0.96 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.97:*:*:*:*:*:*:* Versions 0.97 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.98:*:*:*:*:*:*:* Versions 0.98 Vulnerable ·Usermin
  • cpe:2.3:a:usermin:usermin:0.99:*:*:*:*:*:*:* Versions 0.99 Vulnerable ·Usermin
  • cpe:2.3:a:webmin:webmin:1.0.50:*:*:*:*:*:*:* Versions 1.0.50 Vulnerable ·Webmin
  • cpe:2.3:a:webmin:webmin:1.0.60:*:*:*:*:*:*:* Versions 1.0.60 Vulnerable ·Webmin

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2003-0101
  2. 2026-10-03 Alias added: GHSA-hm72-qxg7-34pg

References

Advisory 6

Other 6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences