Stored Cross-Site Scripting Vulnerability in Webmin and Usermin Products
CVE-2023-41155

5.4MEDIUM

Key Information:

Vendor

Webmin

Status
Webmin
Usermin
Vendor
CVE Published:
13 September 2023

What is CVE-2023-41155?

A vulnerability allows remote attackers to exploit a Stored Cross-Site Scripting (XSS) flaw in the mail forwarding and replies tab of Webmin and Usermin 2.000. By manipulating the 'forward to' field when setting up a mail forwarding rule, an attacker can inject arbitrary web scripts or HTML code. This exploitation could lead to unauthorized access and potentially affect other users accessing the compromised system.

References

https://webmin.com/tags/webmin-changelog/
https://github.com/shindeanik/Usermin-2.000/blob/main/CVE...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-41155 : Stored Cross-Site Scripting Vulnerability in Webmin and Usermin Products