CVE-2001-1074
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when...
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.
Exploit likelihood
What each source reports
NVD Score used
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.
- Record
CVE-2001-1074- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.
- Record
CVE-2001-1074- Updated
- 2026-11-02
EUVDEUVD-2001-1055 No score
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.
- Record
EUVD-2001-1055- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jq2r-96cm-ch8h No score
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when...
Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.
- Record
GHSA-jq2r-96cm-ch8h- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2001-1074 is a high vulnerability (CVSS 7.2) in Webmin, published May 28, 2001. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.51%, the 43rd percentile. No source names a fixed version.
References
securityfocus.com/bid/2795
archives.neohapsis.com/archives/bugtraq/2001-05/0262.html
exchange.xforce.ibmcloud.com/vulnerabilities/6627
calderasystems.com/support/security/advisories/CSSA-2001-019.1.txt
linux-mandrake.com/en/security/2001/MDKSA-2001-059.php3
nvd.nist.gov/vuln/detail/CVE-2001-1074
github.com/advisories/GHSA-jq2r-96cm-ch8h