CVE-2002-1672: Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), wh...

Security readout for executives and security teams

CVE-2002-1672 is an old Webmin 0.92 packaging issue. RPM installations created /var/webmin as world readable, allowing local users to read root cookie-based authentication credentials. That could let a local user take over a root Webmin session. The source bundle does not show active exploitation or a CVSS score. Exposure is most likely on legacy systems still running Webmin 0.92 installed from an RPM. The attacker condition described is local user access, so shared Linux hosts, jump boxes, or systems with many shell accounts are higher concern than isolated hosts. Treat this as a cleanup priority for legacy infrastructure. It is not shown as actively exploited, but any affected host could allow a local user to assume root Webmin access. Prioritize systems with multiple local users or administrative network reach. Mitigation focus: Identify any Webmin 0.92 RPM installations and prioritize replacement or upgrade.; Review Webmin vendor change notes for the appropriate fixed version or guidance.; Correct /var/webmin permissions so unprivileged users cannot read sensitive credentials..

Prepared

Jun 29, 2026, 19:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.