Lucene search

[email protected]NVD:CVE-2023-38310

HistoryJul 31, 2023 - 3:15 p.m.

CVE-2023-38310

2023-07-3115:15:10

CWE-79

[email protected]

web.nvd.nist.gov

webmin

stored cross-site scripting

configuration settings

system logs

vulnerability

log files

xss payload

execution

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

30.2%

JSON

An issue was discovered in Webmin 2.021. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the configuration settings of the system logs functionality. The vulnerability allows an attacker to store an XSS payload in the configuration settings of specific log files. This results in the execution of that payload whenever the affected log files are accessed.

Affected configurations

Nvd

Node

webminwebminMatch2.021

VendorProductVersionCPE
webminwebmin2.021cpe:2.3:a:webmin:webmin:2.021:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
webmin	webmin	2.021	cpe:2.3:a:webmin:webmin:2.021:::::::*

References

github.com/jaysharma786/Webmin-2.021/blob/main/CVE-2023-38310

webmin.com/tags/webmin-changelog/