PT-2024-5589 · Webmin+1 · Webmin+1

Toshitsugu Yoneyama · Published 2024-07-09 · Updated 2024-09-17 · CVE-2024-36450

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Webmin versions prior to 1.910

Description A cross-site scripting vulnerability exists in the sysinfo.cgi of Webmin. If this issue is exploited, an arbitrary script may be executed on the web browser of the user who accessed the website using the product. As a result, a session ID may be obtained, a webpage may be altered, or a server may be halted.

Recommendations For Webmin versions prior to 1.910, update to version 1.910 or later to resolve the issue. As a temporary workaround, consider restricting access to the sysinfo.cgi script until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-06274

CVE-2024-36450

Affected Products

Red Os

Webmin

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-36450 · Security Note
• https://osv.dev/vulnerability/CVE-2024-36450 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06274 · Security Note
• https://twitter.com/VulmonFeeds/status/1810989585310044176 · Twitter Post
• https://t.me/cvedetector/522 · Telegram Post
• https://t.me/cvenotify/85666 · Telegram Post
• https://jvn.jp/en/jp/JVN81442045 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-webmin-cve-2024-36450 · Note
• https://twitter.com/CVEnew/status/1810944901036790099 · Twitter Post
• https://t.me/cvenotify/88076 · Telegram Post
• https://webmin.com · Note