PT-2023-27827 · Webmin+1 · Webmin+1

Published 2023-09-13 · Updated 2023-09-15 · CVE-2023-41152

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Usermin version 2.000 Webmin and Usermin version 2.000

Description A Stored Cross-Site Scripting (XSS) issue exists in the MIME type programs tab, allowing remote attackers to inject arbitrary web script or HTML via the handle program field while creating a new MIME type program.

Recommendations For Usermin version 2.000, consider disabling the MIME type programs tab until a patch is available. For Webmin and Usermin version 2.000, restrict access to the MIME type programs tab to minimize the risk of exploitation. Avoid using the handle program field in the affected MIME type programs tab until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-41152

Affected Products

Usermin

Webmin

References · 5

• 🔥 https://github.com/shindeanik/Usermin-2.000/blob/main/CVE-2023-41152 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-41152 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41152 · Vendor Advisory
• https://twitter.com/CVEnew/status/1702067575050375478 · Twitter Post
• https://webmin.com/tags/webmin-changelog · Note