| Package | Affected versions | Patched versions |
|---|---|---|
| usermin | = 1.070 | |
| webmin | = 1.1.40 |
The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free