Exploitation Summary
EIP tracks 3 public exploits for CVE-2024-44762. PoCs published by Kjesper, arbaaz29. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit performs username enumeration in Usermin <= 2.100 by leveraging differential error messages in the password change functionality. It sends POST requests with fake credentials and checks for specific error responses to identify valid usernames.
Description
A discrepancy in error messages for invalid login attempts in Webmin Usermin v2.100 allows attackers to enumerate valid user accounts.
Exploits (3)
This exploit performs username enumeration in Usermin <= 2.100 by leveraging differential error messages in the password change functionality. It sends POST requests with fake credentials and checks for specific error responses to identify valid usernames.
This exploit performs username enumeration in Webmin Usermin <= 2.100 by leveraging a password change endpoint that leaks user existence via distinct error messages. It iterates through a wordlist and checks responses for specific strings indicating valid or invalid usernames.
This script exploits CVE-2024-44762, a username enumeration vulnerability in Usermin 2.100. It sends crafted POST requests to the password_change.cgi endpoint and checks for specific error messages to determine valid usernames.
Nuclei Templates (1)
title:"Usermin"
app="Usermin"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N