PT-2023-27732 · Webmin · Webmin

Published 2023-09-14 · Updated 2023-09-20 · CVE-2023-40985

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webmin version 2.100

Description An issue was discovered in the File Manager functionality, allowing an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when any file is searched or replaced.

Recommendations For Webmin version 2.100, consider disabling the File Manager functionality until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the File Manager to minimize the risk of arbitrary code injection. Avoid using the File Manager for searching or replacing files until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-40985

Affected Products

Webmin

References · 6

• 🔥 https://github.com/Vi39/Webmin-2.100/blob/main/CVE-2023-40985 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-40985 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40985 · Vendor Advisory
• https://t.me/cvenotify/58164 · Telegram Post
• https://twitter.com/CVEnew/status/1702488058988298265 · Twitter Post
• http://webmin.com · Note