PT-2023-27827 · Webmin+1 · Webmin+1

Publicado 2023-09-13 · Atualizado 2023-09-15 · CVE-2023-41152

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Usermin version 2.000 Webmin and Usermin version 2.000

Description A Stored Cross-Site Scripting (XSS) issue exists in the MIME type programs tab, allowing remote attackers to inject arbitrary web script or HTML via the handle program field while creating a new MIME type program.

Recommendations For Usermin version 2.000, consider disabling the MIME type programs tab until a patch is available. For Webmin and Usermin version 2.000, restrict access to the MIME type programs tab to minimize the risk of exploitation. Avoid using the handle program field in the affected MIME type programs tab until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-41152

Produtos afetados

Usermin

Webmin

Referências · 5

• 🔥 https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41152 · Exploit
• https://twitter.com/CVEnew/status/1702067575050375478 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-41152 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-41152 · Aviso do Fabricante
• https://webmin.com/tags/webmin-changelog · Nota