Stored XSS Vulnerabilities in Usermin by Webmin
CVE-2023-41157

5.4MEDIUM

Key Information:

Vendor

Webmin

Status
Usermin
Vendor
CVE Published:
16 September 2023

What is CVE-2023-41157?

Usermin 2.000 is affected by multiple stored cross-site scripting (XSS) vulnerabilities, which allow remote attackers to inject arbitrary web scripts or HTML. This can occur via the folder name parameter, specifically when creating folders to manage folder tabs, filter tabs, and mail forwarding tabs. Attackers exploiting these vulnerabilities can execute malicious scripts in the context of the user's session, potentially compromising sensitive information or hijacking user accounts.

References

https://webmin.com/tags/webmin-changelog/
https://github.com/shindeanik/Usermin-2.000/blob/main/CVE...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-41157 : Stored XSS Vulnerabilities in Usermin by Webmin