PT-2023-4159 · Webmin+1 · Webmin+1

Published 2023-07-31 · Updated 2024-09-18 · CVE-2023-38305

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Webmin version 2.021

Description An issue was discovered in the download functionality, allowing an attacker to exploit a Cross-Site Scripting (XSS) vulnerability. By providing a crafted download path containing a malicious payload, an attacker can inject arbitrary code, which is then executed within the context of the victim's browser when the download link is accessed.

Recommendations For Webmin version 2.021, consider disabling the download functionality until a patch is available to prevent exploitation of the XSS vulnerability. Restrict access to the download feature to minimize the risk of arbitrary code execution. As a temporary workaround, avoid using the download link with crafted paths containing malicious payloads. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-04471

CVE-2023-38305

Affected Products

Red Os

Webmin

References · 10

• 🔥 https://github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38305 · Exploit
• https://osv.dev/vulnerability/CVE-2023-38305 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38305 · Security Note
• https://bdu.fstec.ru/vul/2023-04471 · Security Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-webmin-18-09-24 · Note
• https://webmin.com/changelog/webmin-2.100-released · Note
• https://t.me/cibsecurity/67469 · Telegram Post
• https://t.me/cvenotify/55794 · Telegram Post
• https://webmin.com/tags/webmin-changelog · Note