Cross-Site Scripting Vulnerability in Webmin by Virtualmin
CVE-2021-32157

9.6CRITICAL

Key Information:

Vendor

Webmin

Status
Webmin
Vendor
CVE Published:
11 April 2022

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 25%

What is CVE-2021-32157?

A Cross-Site Scripting (XSS) vulnerability has been identified in Webmin 1.973, allowing attackers to inject malicious scripts through the Scheduled Cron Jobs feature. Successful exploitation could lead to unauthorized actions being performed on behalf of users, thereby compromising the system's integrity and security.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-32157
Created by dnr6419

CVE-2021-32157
Created by Mesh3l911

References

https://github.com/Mesh3l911/CVE-2021-32157
x_refsource_MISC

EPSS Score

25% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • Vulnerability published

  • Vulnerability Reserved

  • 👾

    Exploit known to exist

.
CVE-2021-32157 : Cross-Site Scripting Vulnerability in Webmin by Virtualmin