PT-2023-4155 · Webmin+1 · Webmin+1

Published

2023-07-31

·

Updated

2024-09-19

·

CVE-2023-38308

CVSS v2.0

6.4

Medium

VectorAV:N/AC:L/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Webmin version 2.021
Description A Cross-Site Scripting (XSS) issue was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code, leading to the execution of arbitrary JavaScript code within the context of the victim's browser. The vulnerability is related to the lack of protection measures for the web page structure, which can be exploited by a remote attacker to execute arbitrary code.
Recommendations For Webmin version 2.021, as a temporary workaround, consider disabling the HTTP Tunnel functionality until a patch is available. Restrict access to the HTTP Tunnel module to minimize the risk of exploitation. Avoid using third-party domain URLs in the affected functionality until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-04467
CVE-2023-38308

Affected Products

Red Os
Webmin