CVE-2001-1074: Webmin

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

Webmin 0.84 and earlier does not properly clear the HTTP_AUTHORIZATION environment variable when the web server is restarted, which makes authentication information available to all CGI programs and allows local users to gain privileges.

Affected products

• Webmin Webmin: version 0.5 only; version 0.6 only; version 0.7 only; version 0.80 only; version 0.83 only; version 0.84 only

Published 2001-05-28. Last modified 2026-06-16.